Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1565.002 Transmitted Data Manipulation · cyberstrikeus | DecimalAI

cyberstrikeus/T1565.002_transmitted-data-manipulation

SkillScore82Maintained

Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1565.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1565-002-transmitted-data-manipulation/SKILL.md

decimalai skills pull cyberstrikeus-t1565-002-transmitted-data-manipulation --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1565-002-transmitted-data-manipulation/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1565-002-transmitted-data-manipulation/SKILL.md

Raw file: /s/cyberstrikeus-t1565-002-transmitted-data-manipulation/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1565-002-transmitted-data-manipulation.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

—+2% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-33%	0%
case-05	✗→✓	▲ Improved	-49%	0%
case-08	✗→✓	▲ Improved	5%	0%
case-13	✗→✓	▲ Improved	-45%	0%
case-18	✓→✓	＝ Same ✓	11%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1565.002_transmitted-data-manipulation/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1565.002 Transmitted Data Manipulation

> Sub-technique of: T1565

High-Level Description

Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Kill Chain Phase

Impact (TA0040)

Platforms: Linux, macOS, Windows

What to Check

] Identify if Transmitted Data Manipulation technique is applicable to target environment
] Check Linux systems for indicators of Transmitted Data Manipulation
] Check macOS systems for indicators of Transmitted Data Manipulation
] Check Windows systems for indicators of Transmitted Data Manipulation
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Transmitted Data Manipulation by examining the target platforms (Linux, macOS, Windows).

Assess Existing Defenses: Review whether mitigations for T1565.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1041 Encrypt Sensitive Information

Encrypt all important data flows to reduce the impact of tailored modifications on data in transit.

Detection

Detection Strategy of Transmitted Data Manipulation

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------------------- | -------- | ------ | | Transmitted Data Manipulation technique applicable | Low | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1565.002_transmitted-data-manipulation would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:21 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+18%

82% vs 64%

Agent turns

1.0 vs 1.0

Tokens

+2%

2,411.81 vs 2,361.62

fail → pass · 4pass → pass · 14fail → fail · 4

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-18 An engineer asks how data manipulation can occur locally on an endpoint without crossing external routers. According to T1565.002 operational concepts, where can manipulation occur besides network connections?	pass→pass	11,540	13,470	+17%	1	1	0%	1,833	2,032	+11%	0	0	—
case-01 We are reviewing our network infrastructure against potential in-flight data alteration threats corresponding to MITRE ATT&CK T1565.002. Please generate a multi-platform assessment checklist for Linux, macOS, and Windows systems. Provide a structured report that covers platform applicability checks, defense verification steps, recommended encryption controls, and an evaluation of risk findings.	fail→fail	48,077	46,576	-3%	1	1	0%	6,905	6,684	-3%	0	0	—
case-02 Our incident response team needs guidance on how to audit and protect against transmitted data tampering across our cross-platform endpoints. Can you provide a testing and mitigation guide for technique T1565.002? The output should include manual testing procedures, mitigation strategies, relevant CWE associations, and risk severity classifications without assuming pre-packaged atomic tests.	fail→fail	34,526	52,013	+51%	1	1	0%	4,878	7,721	+58%	0	0	—
case-03 I need a security assessment summary for sub-technique T1565.002 focusing on data stream modification risks. Please structure the report to include platform vulnerability indicators, manual testing guidance, defense remediation recommendations, and a risk matrix table.	fail→fail	26,995	28,983	+7%	1	1	0%	3,427	5,267	+54%	0	0	—
case-04 When conducting a risk evaluation for in-flight packet alteration capabilities under MITRE ATT&CK T1565.002, security engineers often default to assigning High or Critical severity due to potential data corruption. What severity level is specifically assigned to this finding in standard T1565.002 assessment frameworks?	fail→pass	18,069	10,218	-43%	1	1	0%	2,039	1,360	-33%	0	0	—
case-05 A security analyst is mapping network data tampering threats (T1565.002) to Common Weakness Enumeration standards and considers tagging it as CWE-319 (Cleartext Transmission) or CWE-345 (Insufficient Verification). Which CWE ID is officially designated for T1565.002?	fail→pass	19,726	15,161	-23%	1	1	0%	2,581	1,328	-49%	0	0	—
case-06 To defend network channels against active data modification attacks in sub-technique T1565.002, should security architects deploy M1022 (Data Encrypted for Impact) or M1041 (Encrypt Sensitive Information) as the official mitigation?	pass→pass	17,295	12,443	-28%	1	1	0%	1,991	1,964	-1%	0	0	—
case-07 An incident responder is classifying an adversary who modifies payload data during transport between microservices. While many team members classify network intercept tactics under TA0006 Credential Access or TA0011 Command and Control, which tactic phase covers T1565.002?	pass→pass	8,925	3,290	-63%	1	1	0%	625	1,183	+89%	0	0	—
case-08 An automated red team operator is writing execution playbooks for network data tampering (T1565.002) and plans to invoke pre-built Atomic Red Team scripts. What is the current status regarding automated Atomic Red Team scripts for T1565.002?	fail→pass	27,152	4,045	-85%	1	1	0%	1,170	1,226	+5%	0	0	—
case-09 A threat hunter needs to know which operating systems are within scope when auditing endpoints for T1565.002 transmitted data alteration capabilities. Does this cover Linux, macOS, and Windows?	pass→pass	12,138	8,572	-29%	1	1	0%	1,624	1,273	-22%	0	0	—
case-10 When documenting data alteration in transit for compliance reporting, an analyst needs the parent MITRE ATT&CK technique code associated with sub-technique T1565.002. Is the parent technique T1565 or T1560?	pass→pass	8,379	8,090	-3%	1	1	0%	586	1,265	+116%	0	0	—
case-11 A compliance officer is auditing network transmission security controls against T1565.002. They expect a large list of diverse mitigation codes. How many formal mitigations are documented for sub-technique T1565.002?	pass→pass	7,583	4,187	-45%	1	1	0%	1,398	1,389	-1%	0	0	—
case-12 A threat research report on transmitted data alteration (T1565.002) seeks to cite real-world adversary campaigns documented in the technique profile. Which U.S. Department of Justice report and vendor APT report are explicitly cited for T1565.002?	pass→pass	26,065	8,940	-66%	1	1	0%	3,824	1,500	-61%	0	0	—
case-13 A Security Operations Center manager wants to establish monitoring rules for T1565.002 and assumes there are multiple built-in detection strategies defined. How many detection strategies are documented for T1565.002?	fail→pass	15,342	2,906	-81%	1	1	0%	2,289	1,255	-45%	0	0	—
case-14 When implementing M1041 Encrypt Sensitive Information to counter sub-technique T1565.002, what primary technical outcome is expected regarding sensitive data flows?	pass→pass	12,374	4,854	-61%	1	1	0%	1,091	1,504	+38%	0	0	—
case-15 In a formal T1565.002 assessment table, what exact string is recorded under the Impact column for the finding 'Transmitted Data Manipulation technique applicable'?	pass→pass	15,830	2,002	-87%	1	1	0%	1,815	1,059	-42%	0	0	—
case-16 A red team lead is building an assessment checklist for T1565.002. What initial step must be verified regarding the target environment before conducting platform-specific indicator checks?	pass→pass	12,744	8,582	-33%	1	1	0%	1,171	1,258	+7%	0	0	—
case-17 When conducting manual testing for T1565.002 without automated atomic scripts, what preliminary step should security testers perform regarding existing defenses before running tests?	pass→pass	14,717	8,651	-41%	1	1	0%	1,474	1,343	-9%	0	0	—
case-19 When assessing adversary capabilities required to execute tailored data modification on complex proprietary protocols, what level of adversary expertise and access is identified for T1565.002?	pass→pass	17,053	3,740	-78%	1	1	0%	1,734	1,408	-19%	0	0	—
case-20 Our database auditing team is assessing risks related to unauthorized modification of static records at rest in SQL databases under MITRE ATT&CK sub-technique T1565.001. Should we classify this finding using CWE-400 and mitigation M1041 Encrypt Sensitive Information?	fail→fail	20,919	15,488	-26%	1	1	0%	2,740	3,203	+17%	0	0	—
case-21 Our endpoint defense team is analyzing memory injection and process manipulation threats under MITRE ATT&CK sub-technique T1565.003 (Runtime Data Manipulation). Should we use M1041 Encrypt Sensitive Information and CWE-400 as our primary baseline controls for process memory protection?	pass→pass	23,969	20,186	-16%	1	1	0%	3,143	3,451	+10%	0	0	—
case-22 We are evaluating ARP spoofing and DNS poisoning risks on local subnets under MITRE ATT&CK T1557 (Adversary-in-the-Middle). Should we map this specific network traffic interception technique to CWE-400 and list it under the Impact tactic phase?	pass→pass	17,076	13,255	-22%	1	1	0%	2,426	3,201	+32%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +18 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 63.6%
Pass rate with the skill: 81.8%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/31/2026, 01:21 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

When conducting a risk evaluation for in-flight packet alteration capabilities under MITRE ATT&CK T1565.002, security engineers often default to assigning High or Critical severity due to potential data corruption. What severity level is specifically assigned to this finding in standard T1565.002 assessment frameworks?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run82

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-4% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.