Detect Runtime Data Manipulation in Sumo Logic CSE
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, threatening the integrity of information presented at runtime. Unlike stored data manipulation which alters data at rest, runtime manipulation intercepts and alters data in memory or during processing before it reaches the display layer — allowing adversaries to show fraudulent information while persisting clean data on disk. APT38 demonstrated this with DYEPACK.FOX, which hooked PDF rendering to redact fraudulent SWIFT transaction records from operator views. Runtime manipulation typically requires process injection (CreateRemoteThread, WriteProcessMemory), DLL hijacking into display application processes, or API hooking of rendering or formatting functions. The technique is particularly dangerous in financial, SCADA, and operational technology environments where displayed data directly informs decisions.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1565 Data Manipulation
- Sub-technique
- T1565.003 Runtime Data Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1565/003/
Sumo Detection Query
_sourceCategory=windows/sysmon
| where EventID in ("7", "8", "10")
| where (
(EventID = "8" and (
TargetImage matches "*\\acrord32.exe" or TargetImage matches "*\\acrobat.exe" or
TargetImage matches "*\\foxitreader.exe" or TargetImage matches "*\\sumatrapdf.exe" or
TargetImage matches "*\\excel.exe" or TargetImage matches "*\\winword.exe" or
TargetImage matches "*\\powerpnt.exe" or TargetImage matches "*\\outlook.exe" or
TargetImage matches "*\\explorer.exe" or TargetImage matches "*\\mmc.exe"
))
or
(EventID = "10" and (
TargetImage matches "*\\acrord32.exe" or TargetImage matches "*\\acrobat.exe" or
TargetImage matches "*\\foxitreader.exe" or TargetImage matches "*\\excel.exe" or
TargetImage matches "*\\winword.exe" or TargetImage matches "*\\outlook.exe"
) and (
SourceImage matches "*\\powershell.exe" or SourceImage matches "*\\pwsh.exe" or
SourceImage matches "*\\cmd.exe" or SourceImage matches "*\\wscript.exe" or
SourceImage matches "*\\cscript.exe" or SourceImage matches "*\\mshta.exe" or
SourceImage matches "*\\rundll32.exe" or SourceImage matches "*\\regsvr32.exe"
))
or
(EventID = "7" and (
Image matches "*\\acrord32.exe" or Image matches "*\\acrobat.exe" or
Image matches "*\\foxitreader.exe" or Image matches "*\\excel.exe" or
Image matches "*\\winword.exe"
) and Signed != "true" and (
!(ImageLoaded matches "*\\Windows\\*") and
!(ImageLoaded matches "*\\Program Files\\Adobe\\*") and
!(ImageLoaded matches "*\\Program Files\\Foxit\\*") and
!(ImageLoaded matches "*\\Program Files\\Microsoft Office\\*") and
!(ImageLoaded matches "*\\Program Files (x86)\\Microsoft Office\\*")
))
)
| eval EventType = if(EventID = "8", "RemoteThreadInjection",
if(EventID = "10", "SuspiciousProcessAccess",
if(EventID = "7", "UnexpectedDllLoad", "Unknown")))
| eval TargetProc = if(!isNull(TargetImage), TargetImage, Image)
| eval SourceProc = if(!isNull(SourceImage), SourceImage, "N/A")
| eval RiskScore = if(EventID = "8", 3,
if(EventID = "10" and (GrantedAccess in ("0x1F0FFF","0x001F","0x0028","0x0020")), 2,
if(EventID = "7", 2, 1)))
| fields _messageTime, Computer, User, EventType, EventID, TargetProc, SourceProc, GrantedAccess, ImageLoaded, RiskScore
| sort by RiskScore, _messageTimeSumo Logic CIP query for detecting T1565.003 Runtime Data Manipulation by analyzing Sysmon events for CreateRemoteThread (EID 8) into display applications, suspicious process access (EID 10) from script interpreters, and unsigned DLL loads (EID 7) into document viewer processes. Events are scored by risk and enriched with detection type labels.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PDF plugin frameworks (e.g., third-party Acrobat plugins installed by the user) that load DLLs from non-standard paths during first run
- Windows compatibility shims applied by Application Compatibility Toolkit that inject into Office processes for older application support
- Antivirus or endpoint security software that hooks into display application processes to scan rendered content
Other platforms for T1565.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CreateRemoteThread Injection into Notepad (Windows Shellcode Proxy)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=notepad.exe, StartAddress=<allocated_address>, StartModule='' (empty — shellcode, not DLL). Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x1F0FFF. Security Event ID 4688: powershell.exe process creation with the injection command line.
- Test 2DLL Injection via LoadLibrary into Explorer (Reflective Load Simulation)
Expected signal: Sysmon Event ID 8 (CreateRemoteThread): SourceImage=powershell.exe, TargetImage=explorer.exe, StartAddress=<LoadLibraryW_address>, StartModule=C:\Windows\System32\kernel32.dll, StartFunction=LoadLibraryW. Sysmon Event ID 7 (ImageLoad) in explorer.exe process showing version.dll load if not already present. Sysmon Event ID 10: GrantedAccess=0x1F0FFF from powershell.exe into explorer.exe.
- Test 3Linux LD_PRELOAD Injection to Intercept Display Library Functions
Expected signal: Linux audit log (auditd): execve syscall for gcc compilation of the shared library. execve syscall for the LD_PRELOAD bash invocation with the environment variable set. syslog/auth.log: LD_PRELOAD environment variable may appear in process accounting. Sysmon for Linux (if deployed): EventCode 1 (Process Create) with CommandLine containing 'LD_PRELOAD' and the .so path. File creation events for /tmp/intercept_display.c and /tmp/intercept_display.so.
- Test 4Inline Function Hook (IAT Patch) in Running Process via PowerShell
Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=notepad.exe, GrantedAccess=0x0410 (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ). Security Event ID 4688: powershell.exe execution with the command line. If AV is monitoring OpenProcess calls on non-EDR processes, an additional alert may fire from the security product.
References (10)
- https://attack.mitre.org/techniques/T1565/003/
- https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
- https://www.justice.gov/opa/press-release/file/1092091/download
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md
- https://www.elastic.co/security-labs/detecting-process-injection-with-windows-defender-atp
- https://www.ired.team/offensive-security/code-injection-process-injection/import-adress-table-iat-hooking
- https://man7.org/linux/man-pages/man8/ld.so.8.html
Unlock Pro Content
Get the full detection package for T1565.003 including response playbook, investigation guide, and atomic red team tests.