Techniques › T1491
T1491 Defacement
impact — Windows, IaaS, Linux, macOS, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1491
0
KEV CVEs mapped here
<p>Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 75.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v20.0
- DET0238 Defacement via File and Web Content Modification Across Platforms v1.0
AN0662 WindowsAdversary modifies website or application-hosted content via unauthorized file changes or script injections, often by exploiting web servers or CMS access.WinEventLog:Application
Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files→ DC0038 Application Log ContentTunable:target_filenamesTimeWindowAN0663 LinuxAdversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.apache:access_logUnusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders→ DC0085 Network Traffic Contentlinux:syslogUnauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http→ DC0032 Process CreationTunable:UploadPathRegexFileExtensionScopeAN0664 macOSAdversary modifies internal or external site content through manipulated application bundles, hosted content, or web server configs.macos:unifiedlogExecution of unexpected terminal or web scripts modifying /Library/WebServer/Documents→ DC0032 Process Creationmacos:unifiedlogFile creation or overwrite in common web-hosting folders→ DC0061 File ModificationTunable:TargetDirectoryPathAN0665 ESXiAdversary defaces internal VM-hosted portals or web UIs by modifying static content on datastore-mounted paths.esxi:vmkernelUnauthorized file modifications within datastore volumes via shell access or vCLI→ DC0061 File ModificationTunable:DatastoreVolumeNameAN0666 IaaSAdversary uses compromised instance credentials or web application access to deface content hosted in S3 buckets, Azure Blob Storage, or GCP Buckets.Tunable:BucketNameRegexIAMRoleContext
Sigma rules · SigmaHQ c04ad420b4, tag attack.t1491
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.