Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1565 Data Manipulation · cyberstrikeus | DecimalAI

cyberstrikeus/T1565_data-manipulation

SkillScore82Maintained

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1565

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1565-data-manipulation/SKILL.md

decimalai skills pull cyberstrikeus-t1565-data-manipulation --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1565-data-manipulation/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1565-data-manipulation/SKILL.md

Raw file: /s/cyberstrikeus-t1565-data-manipulation/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1565-data-manipulation.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +32% lift+17% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-07	✗→✓	▲ Improved	13%	0%
case-10	✗→✓	▲ Improved	80%	0%
case-14	✗→✓	▲ Improved	-3%	0%
case-15	✗→✓	▲ Improved	-47%	0%
case-16	✗→✓	▲ Improved	11%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1565_data-manipulation/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1565 Data Manipulation

High-Level Description

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Kill Chain Phase

Impact (TA0040)

Platforms: Linux, macOS, Windows

What to Check

] Identify if Data Manipulation technique is applicable to target environment
] Check Linux systems for indicators of Data Manipulation
] Check macOS systems for indicators of Data Manipulation
] Check Windows systems for indicators of Data Manipulation
] Verify mitigations are bypassed or absent (4 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Data Manipulation by examining the target platforms (Linux, macOS, Windows).

Assess Existing Defenses: Review whether mitigations for T1565 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1041 Encrypt Sensitive Information

Consider encrypting important information to reduce an adversary’s ability to perform tailored data modifications.

M1029 Remote Data Storage

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.

M1030 Network Segmentation

Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

M1022 Restrict File and Directory Permissions

Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.

Detection

Detection Strategy for Data Manipulation

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------- | -------- | ------ | | Data Manipulation technique applicable | Low | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1565_data-manipulation would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:24 UTC · 22 cases

Lift

+32%

82% vs 50%

Agent turns

1.0 vs 1.0

Tokens

+17%

2,961.91 vs 2,541.36

fail → pass · 7pass → pass · 11fail → fail · 4

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We need to evaluate our enterprise security baseline across Linux, macOS, and Windows systems specifically regarding risks related to unauthorized data tampering. Please review our current posture, provide a structured checklist of defensive verification steps, outline the key mitigation controls we should implement, and present the risk severity classification in a summary table.	fail→fail	30,013	43,509	+45%	1	1	0%	3,843	7,239	+88%	0	0	—
case-02 Our security team is conducting a readiness assessment for data integrity threats across our hybrid infrastructure. Can you generate an actionable assessment workflow that details how to check for vulnerability to data modification, summarizes recommended defensive controls like backups and permission restricting, and formats the output into a clear executive report with identified CWE mappings?	fail→fail	25,428	39,818	+57%	1	1	0%	3,523	6,567	+86%	0	0	—
case-03 I am preparing a security architecture review to address risks around internal data manipulation in our multi-platform environment. Please analyze the relevant attack surface across supported operating systems, list the essential mitigation strategies to lower exposure, and output a structured breakdown including risk findings and standard CWE identifiers.	fail→fail	29,879	43,356	+45%	1	1	0%	4,126	6,580	+59%	0	0	—
case-04 We are developing a threat model for targeted ransomware attacks where adversaries encrypt host data to demand payment (MITRE ATT&CK T1486). Please detail the primary tactics, techniques, and mitigations (such as M1053 Data Backup and M1020 Operating System Configuration) specifically for ransomware and data encryption for impact.	pass→pass	28,093	24,403	-13%	1	1	0%	3,815	4,195	+10%	0	0	—
case-05 Our incident response team is writing a playbook for handling wiper malware that permanently destroys system disk contents and file systems (MITRE ATT&CK T1485). Please summarize the key indicators of compromise, recovery steps, and specific wiper mitigations.	pass→pass	23,678	22,021	-7%	1	1	0%	2,740	4,134	+51%	0	0	—
case-06 We are auditing a web application susceptible to SQL injection where attackers manipulate database queries to extract or corrupt records. Please provide a web appsec remediation guide focusing on parameterized queries and CWE-89 mitigations.	pass→pass	25,842	14,602	-43%	1	1	0%	3,087	3,353	+9%	0	0	—
case-07 When preparing automated red team simulation scripts for MITRE ATT&CK technique T1565 across Windows and Linux, security engineers often assume pre-built open-source test harnesses exist. Can you clarify the availability of official Atomic Red Team test scripts for T1565 and outline how testing must be executed?	fail→pass	27,065	23,264	-14%	1	1	0%	3,410	3,869	+13%	0	0	—
case-08 During a threat matrix update for MITRE ATT&CK T1565 Data Manipulation, our SOC analysts are debating its position in the Cyber Kill Chain and which operating systems are in scope. Provide the designated kill chain phase and target platform coverage for T1565.	pass→pass	7,594	2,021	-73%	1	1	0%	1,363	1,285	-6%	0	0	—
case-09 Our enterprise infrastructure team needs a standard mitigation plan for MITRE ATT&CK T1565 Data Manipulation. Many engineers advocate solely for endpoint detection agents or custom firewall rules. What are the four specific MITRE ATT&CK mitigations assigned to counteract T1565?	pass→pass	14,365	11,519	-20%	1	1	0%	2,337	2,025	-13%	0	0	—
case-10 To safeguard critical enterprise data from unauthorized modification under MITRE ATT&CK T1565, our DR team is considering local secondary disk backups or cloud snapshots. Which exact MITRE mitigation addresses taking regular backups stored off-system to restore data after tampering?	fail→pass	5,071	4,323	-15%	1	1	0%	917	1,652	+80%	0	0	—
case-11 When evaluating defenses against unauthorized data edits in financial record systems, our architecture team is selecting MITRE ATT&CK mitigations over general cryptographic frameworks like FIPS 140-3. Which specific MITRE mitigation focuses on lowering exposure to tailored data modifications through encryption of sensitive data?	pass→pass	13,239	8,760	-34%	1	1	0%	1,348	1,505	+12%	0	0	—
case-12 Our Linux and Windows system administrators are configuring access permissions to prevent data tampering under MITRE ATT&CK T1565. Which exact MITRE mitigation control applies least-privilege access rules to vital file assets?	pass→pass	11,483	2,820	-75%	1	1	0%	1,109	1,416	+28%	0	0	—
case-13 In our industrial control architecture review for MITRE ATT&CK T1565, engineers suggest implementing perimeter firewalls. Which specific MITRE mitigation prescribes network segmentation to isolate critical business processes against unauthorized tampering?	pass→pass	14,517	3,033	-79%	1	1	0%	1,326	1,515	+14%	0	0	—
case-14 Our appsec vulnerability management program requires mapping MITRE ATT&CK T1565 Data Manipulation to its associated Common Weakness Enumeration category. Security leads suspect it maps to CWE-345 or CWE-276. What is the precise CWE category assigned to T1565?	fail→pass	20,127	14,438	-28%	1	1	0%	2,650	2,570	-3%	0	0	—
case-15 We are researching documented real-world cyber campaigns involving financial system data manipulation (MITRE ATT&CK T1565) to present to leadership. The security team assumes SolarWinds or Stuxnet reports are the standard reference. Which specific threat research paper or vendor report from January 2022 provides a notable case study on data modification?	fail→pass	23,287	10,571	-55%	1	1	0%	3,719	1,989	-47%	0	0	—
case-16 In our qualitative risk assessment report for MITRE ATT&CK T1565 applicability, auditors insist on classifying the risk severity as High or Critical due to potential operational disruption. According to standard evaluation matrices, what severity level and impact phase should be documented for an applicable T1565 finding?	fail→pass	18,910	14,553	-23%	1	1	0%	2,283	2,543	+11%	0	0	—
case-17 A threat hunter is building a verification matrix for MITRE ATT&CK T1565 Data Manipulation across enterprise assets. The hunter assumes only Windows servers need checking. Which specific operating system platforms must be explicitly checked for indicators of data modification in this baseline check?	pass→pass	6,201	2,443	-61%	1	1	0%	1,153	1,389	+20%	0	0	—
case-18 An internal red team wants to construct a manual test plan for MITRE ATT&CK T1565. Because automated atomic scripts are unavailable, red teamers want to write custom python scripts without defining strategic test steps. What are the initial manual testing steps required to execute an assessment for data manipulation vulnerability?	fail→fail	17,333	27,554	+59%	1	1	0%	2,834	2,903	+2%	0	0	—
case-19 During a SOC detection gap audit for MITRE ATT&CK T1565 Data Manipulation, engineers assume multiple advanced machine-learning detection strategies are defined in the baseline. How many distinct detection strategies are specified for assessing detection coverage of T1565?	fail→pass	22,678	2,199	-90%	1	1	0%	3,097	1,325	-57%	0	0	—
case-20 Our disaster recovery team is updating server backup policies to defend against MITRE ATT&CK T1565. The team suggests keeping backups on a local secondary storage volume. What critical storage restriction must be applied to backups under M1029 to prevent adversaries from manipulating them?	pass→pass	16,374	13,183	-19%	1	1	0%	1,745	2,305	+32%	0	0	—
case-21 Our compliance team is auditing baseline checks for MITRE ATT&CK T1565 Data Manipulation and assumes 10 mitigations need bypass verification. How many known mitigations must be verified as bypassed or absent during the defensive check process?	fail→pass	36,943	8,731	-76%	1	1	0%	3,118	1,561	-50%	0	0	—
case-22 When presenting an executive summary on MITRE ATT&CK T1565 Data Manipulation, our CISO assumes the sole adversary goal is data destruction or extortion. What core organizational business impacts should be highlighted as the primary objective of data manipulation?	pass→pass	15,951	22,088	+38%	1	1	0%	2,367	3,242	+37%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 81.8%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/31/2026, 01:24 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-07

Prompt

When preparing automated red team simulation scripts for MITRE ATT&CK technique T1565 across Windows and Linux, security engineers often assume pre-built open-source test harnesses exist. Can you clarify the availability of official Atomic Red Team test scripts for T1565 and outline how testing must be executed?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run82

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+18% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.