Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering.
Upgrade to ProDetect Stored Data Manipulation — Unauthorized Bulk Modification of Production Database Records in CrowdStrike LogScale
Unlike destruction or encryption, stored data manipulation (T1565.001) is a stealthy Impact objective: the adversary alters records in place — falsifying financial transactions, backdating timestamps, adjusting inventory or pricing data, or planting false log entries — specifically so the tampering is not immediately obvious and can influence downstream business decisions, financial reporting, or an investigation. Because the goal is integrity compromise rather than availability loss, the data remains accessible and the application keeps functioning normally, which means traditional outage-based monitoring never fires. The most reliable detection surface is the database's own audit log: a spike in UPDATE/DELETE statement volume from a single principal against production tables, especially when that principal is a service account not normally used for ad hoc interactive queries, or when the activity occurs outside any tracked change-management window. A second useful signal is direct execution of interactive query tools (ssms.exe, azuredatastudio.exe, mysql.exe, psql.exe) by a service account that should only ever connect programmatically — a strong indicator that stolen service-account credentials are being used for manual, off-process data tampering rather than application logic performing routine writes.
MITRE ATT&CK
- Tactic
- Impact
LogScale Detection Query
#event_simpleName=ProcessRollup2
| FileName = /(?i)(ssms|azuredatastudio|mysql|psql|dbeaver)(\.exe)?$/
| UserName = /(?i)^svc_/
| groupBy([ComputerName, UserName, FileName], function=[count(as=EventCount)])
| sort(EventCount, order=desc)CrowdStrike LogScale query flagging service accounts (username prefix svc_) launching interactive database query tools, using Falcon ProcessRollup2 events — a proxy signal for manual off-process database access consistent with stored data manipulation. Pair with native database audit log ingestion for the bulk-write-volume signal, which falls outside endpoint telemetry.
Data Sources
Required Tables
False Positives & Tuning
- DBA activity under a personal account rather than a service account naming pattern
- Approved break-glass maintenance procedures
Other platforms for THREAT-Impact-ProductionDatabaseRecordTampering
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk UPDATE Volume Spike
Expected signal: Azure SQL/SQL Server audit log shows 120 UPDATE statements from the svc_test principal against TestTable within a 15-minute window.
- Test 2Simulate Service Account Launching Interactive Query Tool
Expected signal: DeviceProcessEvents shows ssms.exe launched with AccountName=svc_appserver.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.