Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering.
Upgrade to ProDetect Stored Data Manipulation — Unauthorized Bulk Modification of Production Database Records in Google Chronicle
Unlike destruction or encryption, stored data manipulation (T1565.001) is a stealthy Impact objective: the adversary alters records in place — falsifying financial transactions, backdating timestamps, adjusting inventory or pricing data, or planting false log entries — specifically so the tampering is not immediately obvious and can influence downstream business decisions, financial reporting, or an investigation. Because the goal is integrity compromise rather than availability loss, the data remains accessible and the application keeps functioning normally, which means traditional outage-based monitoring never fires. The most reliable detection surface is the database's own audit log: a spike in UPDATE/DELETE statement volume from a single principal against production tables, especially when that principal is a service account not normally used for ad hoc interactive queries, or when the activity occurs outside any tracked change-management window. A second useful signal is direct execution of interactive query tools (ssms.exe, azuredatastudio.exe, mysql.exe, psql.exe) by a service account that should only ever connect programmatically — a strong indicator that stolen service-account credentials are being used for manual, off-process data tampering rather than application logic performing routine writes.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule stored_data_manipulation_bulk_writes {
meta:
author = "df00tech Detection Engineering"
description = "Detects anomalous bulk UPDATE/DELETE volume against production database tables by a single principal"
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1565.001"
created = "2026-07-18"
events:
$db.metadata.event_type = "DATABASE_UPDATE" or $db.metadata.event_type = "DATABASE_DELETE"
$db.principal.user.userid = $principal
match:
$principal over 15m
condition:
#db >= 100
}Chronicle YARA-L 2.0 rule using a match-over-time-window aggregation to flag a single database principal generating 100+ DATABASE_UPDATE/DATABASE_DELETE UDM events within 15 minutes.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled batch/ETL jobs
- Legitimate DBA maintenance activity
Other platforms for THREAT-Impact-ProductionDatabaseRecordTampering
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk UPDATE Volume Spike
Expected signal: Azure SQL/SQL Server audit log shows 120 UPDATE statements from the svc_test principal against TestTable within a 15-minute window.
- Test 2Simulate Service Account Launching Interactive Query Tool
Expected signal: DeviceProcessEvents shows ssms.exe launched with AccountName=svc_appserver.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.