Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering.
Upgrade to ProDetect Stored Data Manipulation — Unauthorized Bulk Modification of Production Database Records in Splunk
Unlike destruction or encryption, stored data manipulation (T1565.001) is a stealthy Impact objective: the adversary alters records in place — falsifying financial transactions, backdating timestamps, adjusting inventory or pricing data, or planting false log entries — specifically so the tampering is not immediately obvious and can influence downstream business decisions, financial reporting, or an investigation. Because the goal is integrity compromise rather than availability loss, the data remains accessible and the application keeps functioning normally, which means traditional outage-based monitoring never fires. The most reliable detection surface is the database's own audit log: a spike in UPDATE/DELETE statement volume from a single principal against production tables, especially when that principal is a service account not normally used for ad hoc interactive queries, or when the activity occurs outside any tracked change-management window. A second useful signal is direct execution of interactive query tools (ssms.exe, azuredatastudio.exe, mysql.exe, psql.exe) by a service account that should only ever connect programmatically — a strong indicator that stolen service-account credentials are being used for manual, off-process data tampering rather than application logic performing routine writes.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
(
index=azure sourcetype="azure:diagnostics" Category="SQLSecurityAuditEvents"
action_name IN ("UPDATE","DELETE","BATCH UPDATE","BATCH DELETE")
| bucket _time span=15m
| stats count AS WriteCount, values(object_name) AS TablesTouched by server_principal_name, database_name, _time
| where WriteCount >= 100
| eval Indicator="BulkUpdateDeleteVolumeSpike"
| eval RiskScore=if(server_principal_name IN ("svc_appserver","svc_etl","svc_reporting"), 70, 90)
| table _time, server_principal_name, database_name, WriteCount, TablesTouched, Indicator, RiskScore
)
| append [
search index=mde sourcetype="DeviceProcessEvents"
FileName IN ("ssms.exe","azuredatastudio.exe","mysql.exe","psql.exe","dbeaver.exe")
AccountName IN ("svc_appserver","svc_etl","svc_reporting")
| eval Indicator="ServiceAccountLaunchedInteractiveQueryTool", RiskScore=85
| table _time, DeviceName, AccountName, FileName, ProcessCommandLine, Indicator, RiskScore
]
| sort - RiskScoreSPL equivalent of the two-signal stored-data-manipulation detection: bulk UPDATE/DELETE volume spikes from Azure SQL audit logs (or equivalent on-prem SQL audit sourcetype), appended with service-account use of interactive database query tools captured via endpoint process telemetry.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scheduled batch jobs, ETL reprocessing, or data migrations
- DBA maintenance performed under a named personal account rather than a service account
- Legitimate release-window schema/data updates
Other platforms for THREAT-Impact-ProductionDatabaseRecordTampering
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk UPDATE Volume Spike
Expected signal: Azure SQL/SQL Server audit log shows 120 UPDATE statements from the svc_test principal against TestTable within a 15-minute window.
- Test 2Simulate Service Account Launching Interactive Query Tool
Expected signal: DeviceProcessEvents shows ssms.exe launched with AccountName=svc_appserver.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-ProductionDatabaseRecordTampering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.