Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0391 — Detection Strategy for Runtime Data Manipulation.
DET0391

Detection Strategy for Runtime Data Manipulation.

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1097 Analytic 1097
Windows

Monitor for runtime data manipulations by detecting suspicious modification of application binaries, API hooking, or unexpected behavior from processes responsible for rendering or displaying data. Correlate registry edits, process creation, and unexpected binary hash mismatches.

WinEventLog:Sysmon EventCode=11 WinEventLog:Sysmon EventCode=15 WinEventLog:Security EventCode=4657
[MonitoredPaths] Directory paths of business-critical applications where runtime manipulations are most impactful.
[HashBaseline] Expected cryptographic hashes of application binaries used for runtime data display.
AN1098 Analytic 1098
Linux

Detect runtime manipulation by monitoring system calls for modifications to shared libraries, ELF binaries, or environment variables that affect how data is displayed. Look for suspicious writes to application directories and mismatch in binary integrity baselines.

auditd:SYSCALL open, write: File writes to application binaries or libraries at runtime linux:syslog Execution of modified binaries or abnormal library load sequences
[WatchedBinaries] Specific critical application binaries or libraries to monitor for unauthorized changes.
[IntegrityCheckFrequency] Interval for verifying hashes of executables and libraries.
AN1099 Analytic 1099
macOS

Monitor for runtime manipulation by observing changes in application bundles, unexpected signing modifications, and runtime API calls that inject or alter how data is displayed. Detect alterations in CFNetwork or CoreFoundation frameworks responsible for rendering data.

macos:unifiedlog Unexpected application binary modifications or altered signing status macos:osquery CALCULATE: Mismatch in file integrity of critical macOS applications
[AllowedApps] Whitelisted applications expected to handle sensitive runtime data.
[SignatureEnforcement] Policy enforcement for validating application code signing integrity.

Detected Techniques

1

Details

MITRE ID
DET0391
STIX ID
x-mitre-detection-strategy--41107d12-dd2e-439f-af29-1a10dcfcb6ce
Analytics
3
Techniques Detected
1
By Tactic
Impact
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.