T1491.002 — External Defacement

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing…

Sub-technique of Defacement (T1491).

Sigma detection rules (4)

title: "T1491.002 Defacement: External Defacement"
id: 93c8779e-0dde-4949-b9e2-6eb6d6bf61be
description: 'Detects local file-write activity to common web-root directories with web-content extensions, a proxy for website defacement performed on a compromised Windows web server host. Note: genuine "external" defacement of an internet-facing site is typically executed through a web application vulnerability or stolen CMS/admin credentials and is not directly observable in Windows Sysmon/Security telemetry off-host; this rule only covers the case where the defaced web server itself is Windows-based and the attacker writes or overwrites content files locally. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: target_directory, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1491/002
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.impact
  - attack.t1491.002

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_webroot:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\htdocs\'
      - '\www\'
  selection_webcontent:
    TargetFilename|endswith:
      - '.html'
      - '.htm'
      - '.php'
      - '.asp'
      - '.aspx'
      - '.jsp'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_webroot and selection_webcontent and not filter_system_account

falsepositives:
  - Legitimate web content deployments or CI/CD publishing to the web root; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with deployment-account/path allowlists if noise remains.

level: medium

title: "T1491.002 Defacement: External Defacement"
id: e6f3858c-a422-4bcb-a381-f82e1d2fd290
description: 'Behavioral Detection of External Website Defacement across Platforms. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Excludes writes originating from known deploy/CI and package-manager processes (rsync, git, scp/sftp, ansible-playbook, puppet, chef-client, docker, apt/dpkg/yum/dnf) so the rule no longer fires on every routine content deployment to the web root. Tune using: web_root, payload_hash, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1491/002
author: Shahrukh Khan
date: 2026-04-01
license: MIT
tags:
  - attack.impact
  - attack.t1491.002

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains: '/var/www/'
    name|endswith:
      - '.html'
      - '.php'
  filter_deploy:
    exe|endswith:
      - '/rsync'
      - '/git'
      - '/scp'
      - '/sftp-server'
      - '/ansible-playbook'
      - '/puppet'
      - '/chef-client'
      - '/docker'
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/yum'
      - '/dnf'

  condition: selection and not filter_deploy

falsepositives:
  - Legitimate content deployments to the same web_root through tools not in the deploy-process exclusion list (e.g. a custom in-house deploy script or CD runner not named here); payload_hash comparison against a known-good baseline is the real signal here and requires an external file-integrity tool. Note: nametype NORMAL only confirms the path was referenced, not that a write occurred -- a real write additionally needs a paired SYSCALL with write-capable open flags, which this rule does not separately verify, a known detection gap.

level: high

title: "T1491.002 Defacement: External Defacement"
id: 81faa77a-969b-435a-88f0-934462c54121
description: 'Behavioral Detection of External Website Defacement across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: web_root_dir, editor_name.'
references:
  - https://attack.mitre.org/techniques/T1491/002
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.impact
  - attack.t1491.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/scp'
      - '/sftp'
      - '/ditto'
  selection_web:
    CommandLine|contains:
      - '/Library/WebServer/Documents/'
      - 'htdocs'
      - 'index.html'
  condition: selection and selection_web

falsepositives:
  - Web developers routinely push updated index.html and site content to the same document root paths using scp and ditto, so this is only meaningful when the source host or account is not a known deployment pipeline.

level: high

title: "T1491.002 Defacement: External Defacement"
id: b03efe9f-4098-4f27-8c75-a870e32fd8ff
description: 'Behavioral Detection of External Website Defacement across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: bucket_name, region, IAMRole.'
references:
  - https://attack.mitre.org/techniques/T1491/002
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.impact
  - attack.t1491.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_website_config:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutBucketWebsite'
  selection_public_content:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutObject'
    requestParameters.key|endswith:
      - '.html'
      - '.htm'

  condition: selection_website_config or selection_public_content

falsepositives:
  - Legitimate static website hosting configuration and content deployments will match this, so scope to buckets known to be internet-facing and unexpected caller identities.

level: medium

Related sub-techniques

• T1491.001 Internal Defacement

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1491.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan