Home/ MITRE Matrix/ Impact/ T1565.001

T1565.001Stored Data Manipulation

T1565.001 — Stored Data Manipulation is a MITRE ATT&CK technique in the Impact tactic. Clankerusecase tracks 7 detection use cases covering it and 6 threat-intel articles citing it.

Impact

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

6Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1565 · Data Manipulation

Use cases covering this technique (7)

Windows WBAdmin File Recovery From Backup ESCU actions · hunting P [LLM] Unexpected write to Fluentd fluent.conf introducing exec/block-close directives Bespoke install · hunting DSΣPDDCS [LLM] Gitea artifact staging write into a task context from multiple sources (CVE-2026-58426 write path) Bespoke actions · alerting SP [LLM] Vitest Browser Mode node.exe writes/deletes PNG or trace archive outside project into system paths Bespoke actions · alerting DSΣPDDCS [LLM] n8n-MCP destructive workflow version backup deletion (delete/prune/truncate) — CVE-2026-54052 impact Bespoke actions · alerting SΣP [LLM] AI coding agent bulk-deleting JUnit test files after jqwik resolution Bespoke actions · alerting DSPDDCS [LLM] FTP client / Hive (commons-net) overwrites Unix auth files via path-traversal LIST (CVE-2018-1315) Bespoke actions · alerting DSΣPCS

Articles citing this technique (6)

crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-176

crit [GHSA / CRITICAL] CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task art-229

crit [GHSA / CRITICAL] CVE-2026-73653: @vitest/browser: Browser Mode provider commands bypass the file-access permission gate art-234

crit [GHSA / CRITICAL] CVE-2026-54052: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments art-272

high Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection art-421

high Attacking an FTP Client: MGETting more than you bargained for art-3636