tfMITRE ATT&CK technique

Defacement T1491

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS, ESXi
Version: 1.4
Created: 08 April 2019
Last modified: 24 October 2025

Sub-techniques 26 rules across the family · 2 mapped directly to T1491 · 1 of 2 carry rules

.001Internal Defacement4 .002External Defacement0

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Offense vs defense T1491

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

first rule: 2021 Q2

Defacement detection strategy DET0238

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Defacement via File and Web Content Modification Across Platforms

Enterprise

5 platforms

AN0662 · Windows

Adversary modifies website or application-hosted content via unauthorized file changes or script injections, often by exploiting web servers or CMS access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Application	Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
target_filenames	Environment-specific naming of defacement-prone files like 'index.html', 'main.css', 'app.js'.
TimeWindow	Detection based on rapid sequence of file writes and script injections within short time intervals.

AN0663 · Linux

Adversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:syslog	Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http
File ModificationDC0061	auditd:SYSCALL	write
Network Traffic ContentDC0085	apache:access_log	Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UploadPathRegex	Regex for CMS-specific upload directories subject to defacement (e.g., wp-content/uploads).
FileExtensionScope	Types of files to monitor for defacement (e.g., .html, .php, .jsp).

AN0664 · macOS

Adversary modifies internal or external site content through manipulated application bundles, hosted content, or web server configs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents
File ModificationDC0061	macos:unifiedlog	File creation or overwrite in common web-hosting folders

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDirectoryPath	Web root folders will vary depending on how services are configured on macOS (e.g., /Library/WebServer/Documents).

AN0665 · ESXi

Adversary defaces internal VM-hosted portals or web UIs by modifying static content on datastore-mounted paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	esxi:vmkernel	Unauthorized file modifications within datastore volumes via shell access or vCLI

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DatastoreVolumeName	Each environment’s VMFS/volume mounts will vary in name and path.

AN0666 · IaaS

Adversary uses compromised instance credentials or web application access to deface content hosted in S3 buckets, Azure Blob Storage, or GCP Buckets.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage AccessDC0025	AWS:CloudTrail	GetObject, CopyObject
File CreationDC0039	CloudTrail:PutObject	PutObject

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BucketNameRegex	Patterns of S3 or GCP buckets used for static website hosting may vary by organization.
IAMRoleContext	Some uploads may appear benign unless enriched with user/role metadata.

Defacement detections T1491

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs