Cross-source coverage

T1491.002 / ATT&CK

Defacement: External Defacement

1 rule across 1 source.

From MITRE ATT&CK 19.2

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda. External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.

Tactics
Impact
Platforms
Windows · IaaS · Linux · macOS
Telemetry
WinEventLog:SecurityNSM:ConnectionsWinEventLog:Sysmonauditd:SYSCALLNSM:Flowmacos:unifiedlogAWS:CloudTrail

How MITRE says to detect it DET0590

Behavioral Detection of External Website Defacement across Platforms

Windows Analytic 1622

Adversary modifies externally-facing web content by accessing and overwriting hosted HTML/JS/CSS files, typically following web shell deployment, credential abuse, or exploitation of web application vulnerabilities.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • NSM:Connections Unusual POST requests to admin or upload endpoints
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 1623

Adversary compromises a Linux-based web server and modifies hosted web files by exploiting upload vulnerabilities, remote code execution, or replacing index.html via SSH/webshell.

  • auditd:SYSCALL open/write syscalls targeting web directory files
  • NSM:Connections Successful sudo or ssh from unknown IPs
  • NSM:Flow Suspicious POSTs to upload endpoints

macOS Analytic 1624

Adversary modifies web-facing content on macOS via web development environments like MAMP or misconfigured Apache instances, typically with access to the hosting user account or via persistence tools.

  • macos:unifiedlog Terminal/Editor processes modifying web folder
  • macos:unifiedlog loginwindow or sshd events with external IP

IaaS Analytic 1625

Adversary modifies content in cloud-hosted websites (e.g., AWS S3-backed, Azure Blob-hosted sites) by gaining access to management consoles or APIs and uploading altered HTML/JS files.

  • AWS:CloudTrail PutObject
  • AWS:CloudTrail ListBuckets
  • AWS:CloudTrail GetObject, CopyObject

View on attack.mitre.org ↗

elastic/detection-rules

1 rule
Detection Severity Format
AWS S3 Static Site JavaScript File Uploaded High Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.