Techniques › T1491 › AN0663
AN0663 Analytic 0663
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.</p>
- Detects
- T1491 Defacement
- Part of
- DET0238 Defacement via File and Web Content Modification Across Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | write | DC0061 File Modification |
| apache:access_log | Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders | DC0085 Network Traffic Content |
| linux:syslog | Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UploadPathRegex | Regex for CMS-specific upload directories subject to defacement (e.g., wp-content/uploads). |
FileExtensionScope | Types of files to monitor for defacement (e.g., .html, .php, .jsp). |