Techniques › T1565.003 › AN1097
AN1097 Analytic 1097
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor for runtime data manipulations by detecting suspicious modification of application binaries, API hooking, or unexpected behavior from processes responsible for rendering or displaying data. Correlate registry edits, process creation, and unexpected binary hash mismatches.</p>
- Detects
- T1565.003 Runtime Data Manipulation
- Part of
- DET0391 Detection Strategy for Runtime Data Manipulation.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredPaths | Directory paths of business-critical applications where runtime manipulations are most impactful. |
HashBaseline | Expected cryptographic hashes of application binaries used for runtime data display. |