Cross-source coverage

T1491 / ATT&CK

Defacement

11 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.

Tactics
Impact
Platforms
Windows · IaaS · Linux · macOS · ESXi
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:Applicationauditd:SYSCALLapache:access_loglinux:syslogmacos:unifiedlogesxi:vmkernelCloudTrail:PutObjectAWS:CloudTrail

How MITRE says to detect it DET0238

Defacement via File and Web Content Modification Across Platforms

Windows Analytic 0662

Adversary modifies website or application-hosted content via unauthorized file changes or script injections, often by exploiting web servers or CMS access.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Application Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files

Linux Analytic 0663

Adversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.

  • auditd:SYSCALL write
  • apache:access_log Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders
  • linux:syslog Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http

macOS Analytic 0664

Adversary modifies internal or external site content through manipulated application bundles, hosted content, or web server configs.

  • macos:unifiedlog Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents
  • macos:unifiedlog File creation or overwrite in common web-hosting folders

ESXi Analytic 0665

Adversary defaces internal VM-hosted portals or web UIs by modifying static content on datastore-mounted paths.

  • esxi:vmkernel Unauthorized file modifications within datastore volumes via shell access or vCLI

IaaS Analytic 0666

Adversary uses compromised instance credentials or web application access to deface content hosted in S3 buckets, Azure Blob Storage, or GCP Buckets.

  • CloudTrail:PutObject PutObject
  • AWS:CloudTrail GetObject, CopyObject

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 11 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

4 rules
Detection Severity Format
Potential Ransomware Activity Using LegalNotice Message High Sigma
Potentially Suspicious Desktop Background Change Using Reg.EXE Medium Sigma
Potentially Suspicious Desktop Background Change Via Registry Medium Sigma
Replace Desktop Wallpaper by Powershell Low Sigma

socfortress/Wazuh-Rules

4 rules
Detection Severity Format
Sysmon - Event 1: Process creation · Change Wallpaper via PowerShell (T1491.001) High Wazuh XML
Sysmon - Event 1: Process creation · ESXi DCUI Defacement via plink (T1491.001) High Wazuh XML
Sysmon - Event 1: Process creation · Modify LegalNotice Registry (T1491.001) High Wazuh XML
Sysmon - Event 1: Process creation · Modify LegalNotice Registry Text (T1491.001) High Wazuh XML

splunk/security_content

2 rules
Detection Severity Format
Modification Of Wallpaper Undefined SPL
Windows Defacement Modify Transcodedwallpaper File Undefined SPL

elastic/detection-rules

1 rule
Detection Severity Format
AWS S3 Static Site JavaScript File Uploaded High Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.