Detect Runtime Data Manipulation in CrowdStrike LogScale
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, threatening the integrity of information presented at runtime. Unlike stored data manipulation which alters data at rest, runtime manipulation intercepts and alters data in memory or during processing before it reaches the display layer — allowing adversaries to show fraudulent information while persisting clean data on disk. APT38 demonstrated this with DYEPACK.FOX, which hooked PDF rendering to redact fraudulent SWIFT transaction records from operator views. Runtime manipulation typically requires process injection (CreateRemoteThread, WriteProcessMemory), DLL hijacking into display application processes, or API hooking of rendering or formatting functions. The technique is particularly dangerous in financial, SCADA, and operational technology environments where displayed data directly informs decisions.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1565 Data Manipulation
- Sub-technique
- T1565.003 Runtime Data Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1565/003/
LogScale Detection Query
// T1565.003 Runtime Data Manipulation — CrowdStrike LogScale CQL
// Detect injection, DLL hooking, and binary tampering targeting display/document apps
#event_simpleName in (
"CreateRemoteThreadV2",
"ProcessRollup2",
"SuspiciousProcess",
"ModuleLoadV3",
"SuspiciousProcessSuspectedHostOfMaliciousCode"
)
| TargetFileName := lower(TargetFileName)
| ImageFileName := lower(ImageFileName)
| ParentBaseFileName := lower(ParentBaseFileName)
| DisplayAppList := array("acrord32.exe", "acrobat.exe", "foxitreader.exe", "sumatrapdf.exe",
"excel.exe", "winword.exe", "powerpnt.exe", "outlook.exe",
"explorer.exe", "mmc.exe", "wmplayer.exe")
| SuspiciousParentList := array("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe",
"cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| IsDisplayAppTarget := in(field=TargetFileName, values=DisplayAppList)
| IsDisplayAppImage := in(field=ImageFileName, values=DisplayAppList)
| IsSuspiciousParent := in(field=ParentBaseFileName, values=SuspiciousParentList)
| IsRemoteThread := #event_simpleName = "CreateRemoteThreadV2" and IsDisplayAppTarget = true
| IsSuspiciousModuleLoad := #event_simpleName = "ModuleLoadV3" and IsDisplayAppImage = true
and not match(field=ImageFilePath, regex="(?i)(windows\\|program files\\adobe\\|program files\\foxit\\|program files\\microsoft office\\|program files \(x86\)\\microsoft office\\)")
| IsInjectionAttempt := #event_simpleName in ("SuspiciousProcess", "ProcessRollup2")
and IsDisplayAppTarget = true and IsSuspiciousParent = true
| DetectionFired := IsRemoteThread OR IsSuspiciousModuleLoad OR IsInjectionAttempt
| where DetectionFired = true
| eval DetectionType = case(
IsRemoteThread = true, "RemoteThreadInjection",
IsSuspiciousModuleLoad = true, "UnexpectedModuleLoad",
IsInjectionAttempt = true, "SuspiciousParentChildInjection",
true, "Unknown"
)
| eval RiskScore = case(
IsRemoteThread = true, 3,
IsSuspiciousModuleLoad = true, 2,
IsInjectionAttempt = true, 2,
true, 1
)
| groupBy(
[ComputerName, UserName, DetectionType, TargetFileName, ImageFileName, ParentBaseFileName,
CommandLine, RiskScore],
function=count(as=EventCount)
)
| sort(RiskScore, order=desc)CrowdStrike LogScale CQL query detecting T1565.003 Runtime Data Manipulation by correlating CreateRemoteThread events into display/document applications, unexpected module loads into viewer processes from non-standard paths, and suspicious parent-child process relationships where script interpreters launch or interact with PDF readers and Office apps. Groups results by host and detection type with risk scoring.
Data Sources
Required Tables
False Positives & Tuning
- Falcon sensor itself or other CrowdStrike components performing legitimate inspection of document viewer memory for threat detection, generating CreateRemoteThread telemetry
- Microsoft 365 Click-to-Run update service (OfficeClickToRun.exe) loading modules into running Office processes during background patching on endpoints where C2R is not in the allowlist
- Enterprise PDF conversion services (e.g., network print-to-PDF workflows) that automate Acrobat via COM and open process handles from atypical parent processes
Other platforms for T1565.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CreateRemoteThread Injection into Notepad (Windows Shellcode Proxy)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=notepad.exe, StartAddress=<allocated_address>, StartModule='' (empty — shellcode, not DLL). Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x1F0FFF. Security Event ID 4688: powershell.exe process creation with the injection command line.
- Test 2DLL Injection via LoadLibrary into Explorer (Reflective Load Simulation)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=explorer.exe, StartAddress=<LoadLibraryW_address>, StartModule=C:\Windows\System32\kernel32.dll, StartFunction=LoadLibraryW. Sysmon Event ID 7 (ImageLoad) in explorer.exe process showing version.dll load if not already present. Sysmon Event ID 10: GrantedAccess=0x1F0FFF from powershell.exe into explorer.exe.
- Test 3Linux LD_PRELOAD Injection to Intercept Display Library Functions
Expected signal: Linux audit log (auditd): execve syscall for gcc compilation of the shared library. execve syscall for the LD_PRELOAD bash invocation with the environment variable set. syslog/auth.log: LD_PRELOAD environment variable may appear in process accounting. Sysmon for Linux (if deployed): EventCode 1 (Process Create) with CommandLine containing 'LD_PRELOAD' and the .so path. File creation events for /tmp/intercept_display.c and /tmp/intercept_display.so.
- Test 4Inline Function Hook (IAT Patch) in Running Process via PowerShell
Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x0410 (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ). Security Event ID 4688: powershell.exe execution with the command line. If AV is monitoring OpenProcess calls on non-EDR processes, an additional alert may fire from the security product.
References (10)
- https://attack.mitre.org/techniques/T1565/003/
- https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
- https://www.justice.gov/opa/press-release/file/1092091/download
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md
- https://www.elastic.co/security-labs/detecting-process-injection-with-windows-defender-atp
- https://www.ired.team/offensive-security/code-injection-process-injection/import-adress-table-iat-hooking
- https://man7.org/linux/man-pages/man8/ld.so.8.html
Unlock Pro Content
Get the full detection package for T1565.003 including response playbook, investigation guide, and atomic red team tests.