T1565.001 Stored Data Manipulation
sub-techniqueEnterpriseAdversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Isolate
Deceive
Restore
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitymoderate · backed by 9 of 23 mapped controls
- PR.IRTechnology Infrastructure Resiliencemoderate · backed by 6 of 23 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 5 of 23 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (23)
Security controls that mitigate this.
known-exploited CVEs (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-0108US | critical9.1OT critical | KEV | ||
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authenticat… | ||||
| CVE-2022-41328US | high7.1OT critical | KEV | ||
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and bef… | ||||
groups (1)
Threat groups associated with this.
software (2)
Malware and tools associated with this.
Detected by (Sigma) (6)
Sigma detection rules related to this.
source
Where this definition is published.