Data Manipulation
Data manipulation changes information to influence operations or outcomes.
What it means
Data manipulation changes information to influence operations or outcomes. Integrity impact can be serious even when services remain available and nothing is visibly stolen.
An investigation example
A suspicious account modifies business records while keeping their format valid and the application operational.
Evidence to examine
Review record history, authorized workflow, writer identity, approvals, and independent source records.
A common analytical pitfall
Valid syntax and normal service uptime do not establish data integrity or an approved business outcome.
Response considerations
Preserve changed and prior values, contain unauthorized writes, and reconcile affected decisions against trusted records.
Plausible-looking errors can be harder to notice
Data manipulation alters information in a way that influences decisions or operations. Unlike overt deletion, the records may remain readable and appear normal. A changed payment destination, assessment result, or configuration value can produce serious harm without making the application unavailable. Integrity checks therefore need to reflect the business meaning of the data as well as its technical storage.
Determine where the alteration occurred: stored data, an intermediate processing step, or information in transit. Compare authoritative records and audit trails while accounting for legitimate corrections and synchronization behavior. A mismatch establishes a difference, but further evidence is needed to explain which version is trustworthy and how the change happened.
A fictional altered payout record
An academy's finance team notices that a supplier's destination details changed shortly before a scheduled payment. Investigators review the approval workflow, account activity, application audit events, and earlier trusted records. They coordinate with finance to prevent further incorrect action while preserving the sequence for analysis.
Recovery may require more than restoring an old database snapshot. The organization needs to identify legitimate changes made after that point and reconcile affected business actions. It should also correct the access or process weakness that allowed the unauthorized modification. Blindly replacing all recent data could discard valid work and create additional integrity problems.
Compare evidence sources
Create three fictional versions of a sensitive record: the application value, an approved change request, and an earlier export. Describe what each can support and what uncertainty remains. Propose a validation step with the responsible business owner. This teaches integrity reasoning without changing real financial, educational, or operational records.
Ask the business owner which consistency checks matter. A database can remain structurally valid while a payment destination or assessment value becomes wrong. Technical checksums help detect some changes, but they do not establish that a business value was authorized or meaningful.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1565: Data Manipulation