Runtime Data Manipulation

Runtime Data Manipulation [T1565.003]

Information

• Name: Runtime Data Manipulation

• ID: T1565.003

• Tactics: TA0040

• Technique: T1565

Introduction

Runtime Data Manipulation (T1565.003) is a sub-technique categorized under the MITRE ATT&CK framework, specifically within the Data Manipulation (T1565) technique. This sub-technique involves adversaries altering data during runtime to influence application behavior, evade detection mechanisms, or achieve malicious objectives. Attackers accomplish this by modifying data in memory, intercepting and manipulating data in transit, or altering runtime variables and parameters. Understanding this technique is critical for security professionals aiming to identify and mitigate sophisticated adversarial behaviors.

Deep Dive Into Technique

Runtime Data Manipulation encompasses various technical methods and mechanisms attackers employ to alter data actively processed by systems or applications. Key technical details include:

• Memory Manipulation:

  • Attackers inject malicious code into running processes, directly modifying memory addresses or variables.

  • Commonly used techniques include DLL injection, process hollowing, and reflective injection.

  • Tools such as Metasploit, Cobalt Strike, and custom scripts are frequently used to perform these injections.

• API Hooking and Interception:

  • Attackers intercept and modify API calls or system calls at runtime, enabling them to alter data returned to legitimate applications.

  • Techniques include inline hooking, Import Address Table (IAT) hooking, and syscall hooking.

  • Frameworks like Frida and Xposed are commonly utilized to facilitate hooking and runtime manipulation.

• Network Traffic Manipulation:

  • Adversaries intercept network traffic and modify data packets in real-time, altering communication between client-server applications.

  • Tools such as Ettercap, Burp Suite, and mitmproxy are frequently employed for traffic interception and alteration.

• Runtime Variable Alteration:

  • Attackers modify runtime variables, configuration parameters, or environment variables to influence application behavior.

  • Techniques involve leveraging debuggers, runtime scripting environments, or memory editing tools such as Cheat Engine.

When this Technique is Usually Used

Runtime Data Manipulation typically appears in various attack scenarios and stages, including:

• Privilege Escalation:

  • Attackers modify runtime parameters or memory values to escalate privileges within applications or operating systems.

• Defense Evasion:

  • Manipulating runtime data allows adversaries to bypass security controls, evade detection, and conceal malicious activities.

• Credential Theft and Authentication Bypass:

  • Attackers intercept and alter authentication data at runtime, enabling unauthorized access to sensitive resources.

• Persistence and Lateral Movement:

  • Runtime manipulation can be leveraged to maintain persistence by altering application logic or configuration at runtime.

  • Attackers may also manipulate runtime data to facilitate lateral movement across an environment.

• Data Exfiltration and Sabotage:

  • Attackers alter runtime data streams to exfiltrate sensitive information covertly or sabotage data integrity.

How this Technique is Usually Detected

Detecting Runtime Data Manipulation requires a combination of monitoring tools, behavioral analysis, and indicators of compromise (IoCs):

• Endpoint Detection and Response (EDR):

  • Tools such as CrowdStrike Falcon, SentinelOne, and Carbon Black monitor process memory, API calls, and runtime behaviors to detect anomalous activities.

• Memory Analysis and Forensics:

  • Memory scanners and forensic tools (e.g., Volatility Framework, Rekall) can detect injected code, unusual memory allocations, and suspicious hooks.

• Behavioral Analytics and Anomaly Detection:

  • Machine learning-based systems monitor runtime behaviors, API call patterns, and system interactions to detect deviations from baseline behavior.

• Network Monitoring and Intrusion Detection Systems (IDS):

  • Tools like Snort, Suricata, and Zeek identify anomalous network traffic patterns indicative of runtime data interception and manipulation.

• Specific Indicators of Compromise (IoCs):

  • Unusual process injections or hooks detected in memory.

  • Unexpected or unauthorized modifications to runtime variables or environment parameters.

  • Suspicious network traffic patterns, such as unexpected packet modification or interception.

  • Presence of known hooking frameworks or memory editing tools on endpoints.

Why it is Important to Detect This Technique

Early detection of Runtime Data Manipulation is crucial due to the significant potential impacts on systems and networks, including:

• Compromise of Data Integrity:

  • Altering runtime data can lead to incorrect application behavior, corrupted data, and compromised data integrity, affecting business operations and decision-making processes.

• Security Control Bypass:

  • Manipulation at runtime can effectively bypass traditional security measures, enabling attackers to evade detection and persist within compromised environments.

• Unauthorized Access and Credential Theft:

  • Runtime interception and manipulation of authentication data can facilitate unauthorized access, credential theft, and subsequent lateral movement.

• System Stability and Reliability Issues:

  • Runtime data manipulation can cause instability, crashes, or unpredictable behavior in systems and applications, leading to operational disruptions.

• Regulatory and Compliance Violations:

  • Compromise of runtime data can result in unauthorized disclosure or alteration of sensitive data, potentially violating compliance requirements and regulatory standards.

Detecting this technique early helps organizations mitigate risks, minimize damage, and maintain operational integrity and security.

Examples

Real-world examples demonstrating Runtime Data Manipulation include:

• Banking Malware (e.g., TrickBot, Dridex):

  • Attackers use API hooking techniques to intercept and alter financial transactions at runtime, redirecting funds or stealing sensitive information.

  • Tools employed: Custom hooking libraries, DLL injection frameworks.

  • Impact: Financial loss, compromised customer data, regulatory fines.

• APT Groups (e.g., Lazarus Group):

  • Lazarus has utilized runtime memory manipulation to evade detection, escalate privileges, and maintain persistence in targeted environments.

  • Tools employed: Custom malware leveraging runtime injection and manipulation techniques.

  • Impact: Long-term compromise, intellectual property theft, espionage.

• Credential Harvesting (e.g., Mimikatz):

  • Attackers leverage runtime memory manipulation to extract credentials directly from memory, bypassing traditional authentication methods.

  • Tools employed: Mimikatz, custom memory scrapers.

  • Impact: Unauthorized access, lateral movement, privilege escalation.

• Man-in-the-Middle (MitM) Attacks:

  • Attackers intercept and manipulate data in transit at runtime, altering web requests or responses to inject malicious content or harvest credentials.

  • Tools employed: Ettercap, mitmproxy, Burp Suite.

  • Impact: Credential theft, malware distribution, data compromise.

Understanding these real-world examples helps security teams recognize and defend against Runtime Data Manipulation threats effectively.