Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering.
Upgrade to ProDetect Stored Data Manipulation — Unauthorized Bulk Modification of Production Database Records in IBM QRadar
Unlike destruction or encryption, stored data manipulation (T1565.001) is a stealthy Impact objective: the adversary alters records in place — falsifying financial transactions, backdating timestamps, adjusting inventory or pricing data, or planting false log entries — specifically so the tampering is not immediately obvious and can influence downstream business decisions, financial reporting, or an investigation. Because the goal is integrity compromise rather than availability loss, the data remains accessible and the application keeps functioning normally, which means traditional outage-based monitoring never fires. The most reliable detection surface is the database's own audit log: a spike in UPDATE/DELETE statement volume from a single principal against production tables, especially when that principal is a service account not normally used for ad hoc interactive queries, or when the activity occurs outside any tracked change-management window. A second useful signal is direct execution of interactive query tools (ssms.exe, azuredatastudio.exe, mysql.exe, psql.exe) by a service account that should only ever connect programmatically — a strong indicator that stolen service-account credentials are being used for manual, off-process data tampering rather than application logic performing routine writes.
MITRE ATT&CK
- Tactic
- Impact
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
username AS Principal,
UTF8(payload) AS RawEvent,
COUNT(*) OVER (PARTITION BY username) AS WriteCount
FROM events
WHERE
LOGSOURCETYPEID IN (400, 401)
AND (UTF8(payload) ILIKE '%UPDATE%' OR UTF8(payload) ILIKE '%DELETE%')
AND starttime > NOW() - 3600000
GROUP BY username, starttime, payload
HAVING COUNT(*) >= 100
ORDER BY WriteCount DESCQRadar AQL detection over database audit log sources (LOGSOURCETYPEID 400/401 representing SQL Server/Azure SQL audit and generic DB audit DSMs) flagging any principal issuing 100+ UPDATE/DELETE statements within the last hour.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled batch jobs or ETL reprocessing
- Legitimate DBA maintenance activity
Other platforms for THREAT-Impact-ProductionDatabaseRecordTampering
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk UPDATE Volume Spike
Expected signal: Azure SQL/SQL Server audit log shows 120 UPDATE statements from the svc_test principal against TestTable within a 15-minute window.
- Test 2Simulate Service Account Launching Interactive Query Tool
Expected signal: DeviceProcessEvents shows ssms.exe launched with AccountName=svc_appserver.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.