Ember BearG1003 ↗
Is linked to the defacement of several Ukrainian organization websites.1
- Tactic
- Impact
- Platforms
- Windows, IaaS, Linux, macOS
- Version
- 1.2
- Created
- 20 February 2020
- Last modified
- 24 October 2025
An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.[1][2][3] External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.[4]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.External Defacement MITRE reference T1491.002
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Sandworm TeamG0034 ↗
Defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.12
All 2 groups for this technique
Offense vs defense T1491.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
External Defacement detection strategy DET0590
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of External Website Defacement across Platforms
4 platforms
AN1622 · Windows
Adversary modifies externally-facing web content by accessing and overwriting hosted HTML/JS/CSS files, typically following web shell deployment, credential abuse, or exploitation of web application vulnerabilities.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File ModificationDC0061 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Traffic ContentDC0085 | NSM:Connections | Unusual POST requests to admin or upload endpoints |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| target_directory | Web root folder varies by environment, e.g., C:\inetpub\wwwroot |
| UserContext | May vary based on which service account hosts the website |
| TimeWindow | Time between webshell upload and file overwrite may vary |
AN1623 · Linux
Adversary compromises a Linux-based web server and modifies hosted web files by exploiting upload vulnerabilities, remote code execution, or replacing index.html via SSH/webshell.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | auditd:SYSCALL | open/write syscalls targeting web directory files |
| Network Traffic ContentDC0085 | NSM:Flow | Suspicious POSTs to upload endpoints |
| Logon Session MetadataDC0088 | NSM:Connections | Successful sudo or ssh from unknown IPs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| web_root | May differ (e.g., /var/www/html, /srv/http, etc.) |
| payload_hash | Adversary content hash may change across campaigns |
| UserContext | Can range from apache/nginx user to root if escalated |
AN1624 · macOS
Adversary modifies web-facing content on macOS via web development environments like MAMP or misconfigured Apache instances, typically with access to the hosting user account or via persistence tools.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | macos:unifiedlog | Terminal/Editor processes modifying web folder |
| Logon Session MetadataDC0088 | macos:unifiedlog | loginwindow or sshd events with external IP |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| web_root_dir | May include ~/Sites or custom Apache paths |
| editor_name | Text editor or script modifying the files may vary (e.g., nano, VS Code) |
AN1625 · IaaS
Adversary modifies content in cloud-hosted websites (e.g., AWS S3-backed, Azure Blob-hosted sites) by gaining access to management consoles or APIs and uploading altered HTML/JS files.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage EnumerationDC0017 | AWS:CloudTrail | ListBuckets |
| Cloud Storage AccessDC0025 | AWS:CloudTrail | GetObject, CopyObject |
| File CreationDC0039 | AWS:CloudTrail | PutObject |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| bucket_name | Website bucket name varies per org |
| region | Adversary may target multi-region failover setups |
| IAMRole | Attack may leverage stolen cross-account roles or elevated policies |
Data BackupM1053
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.