Data Manipulation

// T1565 — Data Manipulation
// Four-branch detection: audit log clearing, database file tampering,
// bulk file modification bursts, critical path tampering by unexpected processes
let ScriptingEngines = dynamic([
    "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "python.exe", "python3.exe", "perl.exe",
    "php.exe", "node.exe", "ruby.exe", "bash", "sh"
]);
let DatabaseExtensions = dynamic(["mdf", "ldf", "db", "sqlite", "accdb", "mdb", "sql", "bak", "dbf", "frm"]);
let CriticalLogPaths = dynamic([
    "\\windows\\system32\\winevt\\logs",
    "\\inetpub\\logs",
    "\\program files\\microsoft sql server",
    "\\windows\\system32\\config"
]);
let LegitFileActors = dynamic([
    "svchost.exe", "wininit.exe", "lsass.exe", "services.exe",
    "csrss.exe", "MsMpEng.exe", "sqlservr.exe", "sqlagent.exe",
    "taskhostw.exe", "TrustedInstaller.exe", "TiWorker.exe"
]);
// Branch 1: Windows Security/System Audit Log Cleared (Event ID 1102 = Security, 104 = System)
let AuditLogCleared = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (1102, 104)
| project Timestamp=TimeGenerated, DeviceName=Computer,
          AccountName=strcat(SubjectDomainName, "\\", SubjectUserName),
          ProcessName="wevtutil.exe / Windows Event Log",
          CommandLine="N/A",
          FilePath=iff(EventID == 1102, "Windows Security Event Log", "Windows System Event Log"),
          Alert="AuditLogCleared",
          AlertSeverity="Critical";
// Branch 2: Database file modified or created by scripting interpreter
let DatabaseTampering = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileModified", "FileCreated", "FileRenamed")
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| where FileExt in (DatabaseExtensions)
| where InitiatingProcessFileName has_any (ScriptingEngines)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
          ProcessName=InitiatingProcessFileName,
          CommandLine=InitiatingProcessCommandLine,
          FilePath=strcat(FolderPath, "\\", FileName),
          Alert="DatabaseFileTampering",
          AlertSeverity="High";
// Branch 3: Bulk file modification burst — single process modifies 80+ files across 3+ folders in 5 min
let BulkModification = DeviceFileEvents
| where Timestamp > ago(2h)
| where ActionType in ("FileModified", "FileCreated", "FileRenamed", "FileDeleted")
| summarize FileCount=count(),
            FolderCount=dcount(FolderPath),
            SampleFiles=make_set(FileName, 5),
            CommandLine=any(InitiatingProcessCommandLine)
    by DeviceName,
       InitiatingProcessFileName,
       InitiatingProcessAccountName,
       TimeBin=bin(Timestamp, 5m)
| where FileCount > 80 and FolderCount >= 3
| project Timestamp=TimeBin, DeviceName,
          AccountName=InitiatingProcessAccountName,
          ProcessName=InitiatingProcessFileName,
          CommandLine,
          FilePath=strcat("BulkOp (", tostring(FileCount), " files): ", tostring(SampleFiles)),
          Alert="BulkFileModification",
          AlertSeverity="Medium";
// Branch 4: Critical system/log path file modification by unexpected process
let CriticalPathTampering = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileModified", "FileDeleted", "FileRenamed")
| where FolderPath has_any (CriticalLogPaths)
| where InitiatingProcessFileName !in~ (LegitFileActors)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
          ProcessName=InitiatingProcessFileName,
          CommandLine=InitiatingProcessCommandLine,
          FilePath=strcat(FolderPath, "\\", FileName),
          Alert="CriticalPathTampering",
          AlertSeverity="High";
// Union all branches into single alert stream
union AuditLogCleared, DatabaseTampering, BulkModification, CriticalPathTampering
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine,
          Alert, AlertSeverity, FilePath
| sort by Timestamp desc

index=wineventlog
    ((sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11)
    OR (sourcetype="WinEventLog:Security" (EventCode=1102 OR EventCode=104)))
| eval TargetFile=coalesce(TargetFilename, "Windows Event Log")
| eval FileExt=lower(mvindex(split(TargetFile, "."), -1))
| eval IsDbFile=if(match(FileExt,"^(mdf|ldf|db|sqlite|accdb|mdb|sql|bak|dbf|frm)$"), 1, 0)
| eval IsCriticalPath=if(match(lower(TargetFile),
    "(\\\\windows\\\\system32\\\\winevt\\\\logs|\\\\inetpub\\\\logs|\\\\program files\\\\microsoft sql server|\\\\windows\\\\system32\\\\config)"), 1, 0)
| eval IsScriptingEngine=if(match(lower(coalesce(Image, "")),
    "(powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python[23]?\.exe|perl\.exe|bash$|sh$|node\.exe|php\.exe|ruby\.exe|cmd\.exe)"), 1, 0)
| eval IsLegitProcess=if(match(lower(coalesce(Image, "")),
    "(svchost\.exe|wininit\.exe|lsass\.exe|services\.exe|sqlservr\.exe|sqlagent\.exe|msmpeng\.exe|csrss\.exe|trustedinstaller\.exe|tiworker\.exe)"), 1, 0)
| eval AlertType=case(
    EventCode=1102 OR EventCode=104, "AuditLogCleared",
    IsDbFile=1 AND IsScriptingEngine=1, "DatabaseFileTampering",
    IsCriticalPath=1 AND IsLegitProcess=0, "CriticalPathTampering",
    1=1, null()
  )
| where isnotnull(AlertType)
| eval AlertSeverity=case(
    AlertType="AuditLogCleared", "Critical",
    AlertType="DatabaseFileTampering" OR AlertType="CriticalPathTampering", "High",
    1=1, "Medium"
  )
| eval AccountName=coalesce(User, SubjectUserName, "unknown")
| eval ProcessImage=coalesce(Image, "Windows Event Log Service")
| table _time, host, AccountName, ProcessImage, CommandLine, AlertType, AlertSeverity, TargetFile
| sort - _time
| appendcols
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-2h latest=now
    | stats count as FileCount, dc(TargetFilename) as UniqueFolders,
             values(eval(mvindex(split(TargetFilename,"\\"), -1))) as SampleFiles,
             values(CommandLine) as CommandLines
             by host, User, Image, span(_time, 5m)
    | where FileCount > 80 AND UniqueFolders >= 3
    | eval AlertType="BulkFileModification", AlertSeverity="Medium"
    | eval AccountName=User, ProcessImage=Image
    | eval TargetFile=mvjoin(mvindex(SampleFiles, 0, 4), ", ")
    | table _time, host, AccountName, ProcessImage, CommandLines, AlertType, AlertSeverity, TargetFile]

// Branch 1: Audit log cleared (Sysmon EventID 1102 / System 104 equivalent via Windows Security)
sequence by host.name
[
  any where event.code in ("1102", "104") and
  event.provider in ("Microsoft-Windows-Eventlog", "Microsoft-Windows-Security-Auditing")
]

// Branch 2: Database file tampered by scripting engine
file where event.type in ("creation", "change") and
  file.extension in ("mdf", "ldf", "db", "sqlite", "accdb", "mdb", "sql", "bak", "dbf", "frm") and
  process.name in~ (
    "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "python.exe", "python3.exe", "perl.exe",
    "php.exe", "node.exe", "ruby.exe", "bash", "sh"
  )

// Branch 3: Critical path tampering by non-whitelisted process
file where event.type in ("change", "deletion") and
  (
    file.path like~ "*\\windows\\system32\\winevt\\logs*" or
    file.path like~ "*\\inetpub\\logs*" or
    file.path like~ "*\\program files\\microsoft sql server*" or
    file.path like~ "*\\windows\\system32\\config*"
  ) and
  process.name not in~ (
    "svchost.exe", "wininit.exe", "lsass.exe", "services.exe",
    "csrss.exe", "MsMpEng.exe", "sqlservr.exe", "sqlagent.exe",
    "taskhostw.exe", "TrustedInstaller.exe", "TiWorker.exe"
  )

// Branch 1: Audit Log Cleared
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  username AS AccountName,
  sourceip AS SourceIP,
  QIDNAME(qid) AS EventName,
  'AuditLogCleared' AS AlertType,
  'Critical' AS AlertSeverity,
  'Windows Security/System Event Log' AS TargetFile
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13)
  AND (eventid = 1102 OR eventid = 104)
  AND DATEFORMAT(starttime, 'yyyy-MM-dd') = DATEFORMAT(NOW(), 'yyyy-MM-dd')

UNION ALL

// Branch 2: Database File Tampering by Scripting Engine
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  username AS AccountName,
  sourceip AS SourceIP,
  'DatabaseFileTampering' AS EventName,
  'DatabaseFileTampering' AS AlertType,
  'High' AS AlertSeverity,
  CONCAT('File modified: ', UTF8(payload)) AS TargetFile
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND eventid = 11
  AND (
    LOWER(UTF8(payload)) MATCHES '.*\.(mdf|ldf|db|sqlite|accdb|mdb|sql|bak|dbf|frm).*'
  )
  AND (
    LOWER(UTF8(payload)) MATCHES '.*(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python[23]?\.exe|perl\.exe|php\.exe|node\.exe|ruby\.exe|bash|sh).*'
  )
  AND DATEFORMAT(starttime, 'yyyy-MM-dd') = DATEFORMAT(NOW(), 'yyyy-MM-dd')

UNION ALL

// Branch 3: Critical Path Tampering
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  username AS AccountName,
  sourceip AS SourceIP,
  'CriticalPathTampering' AS EventName,
  'CriticalPathTampering' AS AlertType,
  'High' AS AlertSeverity,
  UTF8(payload) AS TargetFile
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND eventid = 11
  AND (
    LOWER(UTF8(payload)) MATCHES '.*(\\windows\\system32\\winevt\\logs|\\inetpub\\logs|\\program files\\microsoft sql server|\\windows\\system32\\config).*'
  )
  AND NOT (
    LOWER(UTF8(payload)) MATCHES '.*(svchost\.exe|wininit\.exe|lsass\.exe|services\.exe|sqlservr\.exe|sqlagent\.exe|msmpeng\.exe|csrss\.exe|trustedinstaller\.exe|tiworker\.exe).*'
  )
  AND DATEFORMAT(starttime, 'yyyy-MM-dd') = DATEFORMAT(NOW(), 'yyyy-MM-dd')

ORDER BY EventTime DESC

// Branch 1: Audit Log Cleared
(_sourceCategory=windows/security OR _sourceCategory=windows/system)
| parse "EventCode=*" as EventCode nodrop
| where EventCode in ("1102", "104")
| eval AlertType = "AuditLogCleared", AlertSeverity = "Critical"
| eval TargetFile = if(EventCode == "1102", "Windows Security Event Log", "Windows System Event Log")
| fields _messageTime, _sourceHost, EventCode, AlertType, AlertSeverity, TargetFile

// Branch 2: Database File Tampering by Scripting Engine
// Run separately in Sumo Logic
_sourceCategory=windows/sysmon
| parse "EventCode=*" as EventCode nodrop
| where EventCode == "11"
| parse "TargetFilename=*\n" as TargetFilename nodrop
| parse "Image=*\n" as Image nodrop
| eval FileExt = toLower(replace(TargetFilename, /^.*\.([^.]+)$/, "$1"))
| where FileExt in ("mdf", "ldf", "db", "sqlite", "accdb", "mdb", "sql", "bak", "dbf", "frm")
| where matches(toLower(Image), "(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python[23]?\.exe|perl\.exe|php\.exe|node\.exe|ruby\.exe|bash|sh)")
| eval AlertType = "DatabaseFileTampering", AlertSeverity = "High"
| fields _messageTime, _sourceHost, Image, TargetFilename, AlertType, AlertSeverity

// Branch 3: Bulk File Modification Burst
// Run separately in Sumo Logic
_sourceCategory=windows/sysmon EventCode=11
| parse "Image=*\n" as Image nodrop
| parse "TargetFilename=*\n" as TargetFilename nodrop
| parse "User=*\n" as User nodrop
| timeslice 5m
| count as FileCount, pct_distinct(TargetFilename, 100) as FolderApprox by _timeslice, _sourceHost, Image, User
| where FileCount > 80
| eval AlertType = "BulkFileModification", AlertSeverity = "Medium"
| fields _timeslice, _sourceHost, User, Image, FileCount, AlertType, AlertSeverity

// Branch 4: Critical Path Tampering
// Run separately in Sumo Logic
_sourceCategory=windows/sysmon EventCode=11
| parse "TargetFilename=*\n" as TargetFilename nodrop
| parse "Image=*\n" as Image nodrop
| parse "User=*\n" as User nodrop
| where matches(toLower(TargetFilename), "(\\\\windows\\\\system32\\\\winevt\\\\logs|\\\\inetpub\\\\logs|\\\\program files\\\\microsoft sql server|\\\\windows\\\\system32\\\\config)")
| where !matches(toLower(Image), "(svchost\.exe|wininit\.exe|lsass\.exe|services\.exe|sqlservr\.exe|sqlagent\.exe|msmpeng\.exe|csrss\.exe|trustedinstaller\.exe|tiworker\.exe)")
| eval AlertType = "CriticalPathTampering", AlertSeverity = "High"
| fields _messageTime, _sourceHost, User, Image, TargetFilename, AlertType, AlertSeverity
| sort by _messageTime desc

rule t1565_data_manipulation {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1565 Data Manipulation: audit log clearing, database file tampering by scripting engines, and critical system path modification by unexpected processes"
    mitre_attack_technique = "T1565"
    mitre_attack_tactic = "Impact"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      // Branch 1: Audit log cleared via Windows event
      (
        $e1.metadata.event_type = "STATUS_UPDATE"
        $e1.metadata.product_event_type = "1102"
        $e1.metadata.product_name = "Microsoft-Windows-Security-Auditing"
      )
      or
      (
        $e1.metadata.event_type = "STATUS_UPDATE"
        $e1.metadata.product_event_type = "104"
        $e1.metadata.product_name = "Microsoft-Windows-Eventlog"
      )
    )
    or
    (
      // Branch 2: Database file tampered by scripting engine (Sysmon Event 11)
      $e1.metadata.event_type = "FILE_CREATION"
      $e1.target.file.full_path = /\.(mdf|ldf|db|sqlite|accdb|mdb|sql|bak|dbf|frm)$/i
      $e1.principal.process.file.full_path = /(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python[23]?\.exe|perl\.exe|php\.exe|node\.exe|ruby\.exe|bash|sh)$/i
    )
    or
    (
      // Branch 3: Critical path tampering by non-whitelisted process
      $e1.metadata.event_type = "FILE_MODIFICATION"
      $e1.target.file.full_path = /(\\windows\\system32\\winevt\\logs|\\inetpub\\logs|\\program files\\microsoft sql server|\\windows\\system32\\config)/i
      not $e1.principal.process.file.full_path = /(svchost\.exe|wininit\.exe|lsass\.exe|services\.exe|csrss\.exe|MsMpEng\.exe|sqlservr\.exe|sqlagent\.exe|taskhostw\.exe|TrustedInstaller\.exe|TiWorker\.exe)$/i
    )

  condition:
    $e1
}

// Branch 1: Audit Log Cleared — Windows Security/System Event IDs 1102 or 104
#event_simpleName = "EventLogCleared" OR
(
  #event_simpleName = "SyntheticNTLM"
  | EventCode in [1102, 104]
)
| table([timestamp, ComputerName, UserName, EventCode, #event_simpleName])
| eval AlertType="AuditLogCleared", AlertSeverity="Critical"

// Branch 2: Database File Tampered by Scripting Engine
// Run in LogScale as a separate query
#event_simpleName = "PeFileWritten" OR #event_simpleName = "SuspiciousFileCreation"
| TargetFileName = /\.(mdf|ldf|db|sqlite|accdb|mdb|sql|bak|dbf|frm)$/i
| ParentBaseFileName = /(powershell|cmd|wscript|cscript|mshta|python[23]?|perl|php|node|ruby|bash|sh)\.exe/i
| eval AlertType="DatabaseFileTampering", AlertSeverity="High"
| table([timestamp, ComputerName, UserName, ParentBaseFileName, TargetFileName, CommandLine, AlertType, AlertSeverity])

// Branch 3: Bulk File Modification Burst (80+ files, 3+ folders, 5 min window)
// Run in LogScale as a separate query
#event_simpleName = "PeFileWritten"
| groupBy([ComputerName, UserName, ParentBaseFileName, bin(timestamp, 5min)], function=[
    count(TargetFileName, as=FileCount),
    count(distinct=true, TargetDirectoryName, as=FolderCount),
    collect(TargetFileName, limit=5, as=SampleFiles)
  ])
| FileCount > 80 AND FolderCount >= 3
| eval AlertType="BulkFileModification", AlertSeverity="Medium"
| table([timestamp, ComputerName, UserName, ParentBaseFileName, FileCount, FolderCount, SampleFiles, AlertType, AlertSeverity])

// Branch 4: Critical Path Tampering by Unexpected Process
// Run in LogScale as a separate query
#event_simpleName = "PeFileWritten"
| TargetDirectoryName = /(\\windows\\system32\\winevt\\logs|\\inetpub\\logs|\\program files\\microsoft sql server|\\windows\\system32\\config)/i
| ParentBaseFileName != /(svchost|wininit|lsass|services|csrss|MsMpEng|sqlservr|sqlagent|taskhostw|TrustedInstaller|TiWorker)\.exe/i
| eval AlertType="CriticalPathTampering", AlertSeverity="High"
| table([timestamp, ComputerName, UserName, ParentBaseFileName, TargetFileName, CommandLine, AlertType, AlertSeverity])
| sort(timestamp, order=desc)