Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Data Manipulation: Stored Data Manipulation

Other sub-techniques of Data Manipulation (3)

ID	Name
.001	Stored Data Manipulation
.002	Transmitted Data Manipulation
.003	Runtime Data Manipulation

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

ID: T1565.001

Sub-technique of: T1565

Tactic(s): Impact

Platforms: Linux, macOS, Windows

Data Sources: File: File Creation, File: File Deletion, File: File Modification

Impact Type: Integrity

Version: 1.1

Created: 02 Mar 2020

Last Modified: 19 Apr 2022

Name	Description
Procedure Examples
SUNSPOT	SUNSPOT created a copy of the SolarWinds Orion software source file with a `.bk` extension to backup the original content, wrote SUNBURST using the same filename but with a `.tmp` extension, and then moved SUNBURST using `MoveFileEx` to the original filename with a `.cs` extension so it could be compiled within Orion software.(Citation: CrowdStrike SUNSPOT Implant January 2021)
APT38	APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.(Citation: FireEye APT38 Oct 2018)

Mitigation	Description
Mitigations
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Remote Data Storage	Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.
Encrypt Sensitive Information	Protect sensitive information with strong encryption.

Detection

Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.