TA0040 · IMPACT
Transmitted Data Manipulation
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.
Detect it with
Detecting the manipulation of data as at passes over a network can be difficult without the appropriate tools. In some cases integrity verification checks, such as file hashing, may be used on critical files as they transit a network.
Why it matters on shift
Transmitted Data Manipulation is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
Kill-chain context