Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering.
Upgrade to ProDetect Stored Data Manipulation — Unauthorized Bulk Modification of Production Database Records in Elastic Security
Unlike destruction or encryption, stored data manipulation (T1565.001) is a stealthy Impact objective: the adversary alters records in place — falsifying financial transactions, backdating timestamps, adjusting inventory or pricing data, or planting false log entries — specifically so the tampering is not immediately obvious and can influence downstream business decisions, financial reporting, or an investigation. Because the goal is integrity compromise rather than availability loss, the data remains accessible and the application keeps functioning normally, which means traditional outage-based monitoring never fires. The most reliable detection surface is the database's own audit log: a spike in UPDATE/DELETE statement volume from a single principal against production tables, especially when that principal is a service account not normally used for ad hoc interactive queries, or when the activity occurs outside any tracked change-management window. A second useful signal is direct execution of interactive query tools (ssms.exe, azuredatastudio.exe, mysql.exe, psql.exe) by a service account that should only ever connect programmatically — a strong indicator that stolen service-account credentials are being used for manual, off-process data tampering rather than application logic performing routine writes.
MITRE ATT&CK
- Tactic
- Impact
Elastic Detection Query
sequence by process.parent.user.name with maxspan=1h
[process where event.type == "start" and process.name : ("ssms.exe", "azuredatastudio.exe", "mysql.exe", "psql.exe", "dbeaver.exe")]Detects a database service account (identified via process.parent.user.name matching known service-account naming patterns at ingest time) launching an interactive database query tool — a strong indicator of manual, off-process data access consistent with stored data manipulation. Pair with database-native audit log ingestion for the bulk-write-volume half of this detection, which is not expressible in endpoint EQL alone.
Data Sources
Required Tables
False Positives & Tuning
- DBA activity performed under a personal named account rather than a flagged service account
- Approved break-glass access procedures using the service account for emergency maintenance
Other platforms for THREAT-Impact-ProductionDatabaseRecordTampering
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk UPDATE Volume Spike
Expected signal: Azure SQL/SQL Server audit log shows 120 UPDATE statements from the svc_test principal against TestTable within a 15-minute window.
- Test 2Simulate Service Account Launching Interactive Query Tool
Expected signal: DeviceProcessEvents shows ssms.exe launched with AccountName=svc_appserver.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.