AN0555
Analytic 0555
Windows
Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=23
WinEventLog:Sysmon
EventCode=15
WinEventLog:Security
EventCode=4663, 4670, 4656
[MonitoredDirectories]
Paths to sensitive stored data files such as database directories or email archives.
[AuthorizedProcesses]
List of legitimate processes expected to create, delete, or modify stored data.
[TimeWindow]
Threshold for correlating multiple suspicious file operations within a short period.
AN0556
Analytic 0556
Linux
Detect suspicious file creation, modification, or deletion in stored data directories (e.g., `/var/lib/mysql/`, `/var/log/`, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.
auditd:SYSCALL
open, unlink, rename: File creation or deletion involving critical stored data
auditd:SYSCALL
write: Modification of structured stored data by suspicious processes
[WatchedPaths]
Environment-specific paths where business-critical stored data resides.
[CommandExclusions]
Legitimate scripts/utilities excluded to minimize false positives.
AN0557
Analytic 0557
macOS
Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.
macos:unifiedlog
Unexpected creation or modification of stored data files in protected directories
macos:osquery
CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes
[FileIntegrityBaseline]
Baseline hash values or metadata for stored data files to detect manipulation.
[AllowedEditors]
Whitelisted applications permitted to update stored data (e.g., Outlook, MySQL).