Detect Runtime Data Manipulation in Elastic Security
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, threatening the integrity of information presented at runtime. Unlike stored data manipulation which alters data at rest, runtime manipulation intercepts and alters data in memory or during processing before it reaches the display layer — allowing adversaries to show fraudulent information while persisting clean data on disk. APT38 demonstrated this with DYEPACK.FOX, which hooked PDF rendering to redact fraudulent SWIFT transaction records from operator views. Runtime manipulation typically requires process injection (CreateRemoteThread, WriteProcessMemory), DLL hijacking into display application processes, or API hooking of rendering or formatting functions. The technique is particularly dangerous in financial, SCADA, and operational technology environments where displayed data directly informs decisions.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1565 Data Manipulation
- Sub-technique
- T1565.003 Runtime Data Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1565/003/
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and
process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "svchost.exe")]
[process where event.action == "process_injection" and
process.name in~ ("acrord32.exe", "acrobat.exe", "foxitreader.exe", "sumatrapdf.exe",
"excel.exe", "winword.exe", "powerpnt.exe", "outlook.exe",
"explorer.exe", "mmc.exe", "wmplayer.exe")]
any where
(
(
event.category == "library" and
process.name in~ ("acrord32.exe", "acrobat.exe", "foxitreader.exe", "excel.exe", "winword.exe") and
not dll.path : ("C:\\Windows\\*", "C:\\Program Files\\Adobe\\*",
"C:\\Program Files\\Foxit\\*", "C:\\Program Files\\Microsoft Office\\*",
"C:\\Program Files (x86)\\Microsoft Office\\*") and
dll.code_signature.trusted == false
) or
(
event.category == "file" and
event.type in ("change", "creation") and
(file.name : "*.exe" or file.name : "*.dll") and
file.path : ("*\\Program Files\\Adobe\\*", "*\\Program Files\\Foxit\\*",
"*\\Program Files\\Microsoft Office\\*", "*\\Program Files (x86)\\Microsoft Office\\*") and
not process.name in~ ("msiexec.exe", "setup.exe", "install.exe",
"trustedinstaller.exe", "tiworker.exe", "svchost.exe")
)
)Detects runtime data manipulation attempts (T1565.003) via process injection into display/document applications, unexpected DLL loads into viewer processes, and unauthorized binary tampering of PDF readers and Office applications. Correlates suspicious source processes with injection into display targets using ECS fields.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Adobe Acrobat plugin installations or updates that load unsigned DLLs transiently before signature verification completes
- IT deployment tools (SCCM, Intune, PDQ Deploy) modifying Office or Acrobat binaries during patch cycles using atypical parent processes
- Security products (EDR agents, DLP tools) legitimately injecting into document viewers for content inspection or DRM enforcement
Other platforms for T1565.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CreateRemoteThread Injection into Notepad (Windows Shellcode Proxy)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=notepad.exe, StartAddress=<allocated_address>, StartModule='' (empty — shellcode, not DLL). Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x1F0FFF. Security Event ID 4688: powershell.exe process creation with the injection command line.
- Test 2DLL Injection via LoadLibrary into Explorer (Reflective Load Simulation)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=explorer.exe, StartAddress=<LoadLibraryW_address>, StartModule=C:\Windows\System32\kernel32.dll, StartFunction=LoadLibraryW. Sysmon Event ID 7 (ImageLoad) in explorer.exe process showing version.dll load if not already present. Sysmon Event ID 10: GrantedAccess=0x1F0FFF from powershell.exe into explorer.exe.
- Test 3Linux LD_PRELOAD Injection to Intercept Display Library Functions
Expected signal: Linux audit log (auditd): execve syscall for gcc compilation of the shared library. execve syscall for the LD_PRELOAD bash invocation with the environment variable set. syslog/auth.log: LD_PRELOAD environment variable may appear in process accounting. Sysmon for Linux (if deployed): EventCode 1 (Process Create) with CommandLine containing 'LD_PRELOAD' and the .so path. File creation events for /tmp/intercept_display.c and /tmp/intercept_display.so.
- Test 4Inline Function Hook (IAT Patch) in Running Process via PowerShell
Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x0410 (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ). Security Event ID 4688: powershell.exe execution with the command line. If AV is monitoring OpenProcess calls on non-EDR processes, an additional alert may fire from the security product.
References (10)
- https://attack.mitre.org/techniques/T1565/003/
- https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
- https://www.justice.gov/opa/press-release/file/1092091/download
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md
- https://www.elastic.co/security-labs/detecting-process-injection-with-windows-defender-atp
- https://www.ired.team/offensive-security/code-injection-process-injection/import-adress-table-iat-hooking
- https://man7.org/linux/man-pages/man8/ld.so.8.html
Unlock Pro Content
Get the full detection package for T1565.003 including response playbook, investigation guide, and atomic red team tests.