T1491.002, External Defacement, is defacement of systems outside the organization's internal network, most visibly its public website. It applies to Windows, IaaS, Linux and macOS and falls under impact.
How attackers use it
An adversary may deface external systems to deliver a message, intimidate, or mislead the organization or its users. This can lead users to distrust the systems and question their integrity. Externally facing websites are common victims, often targeted by hacktivist groups pushing a political message.
MITRE adds two further uses. It can be a catalyst to trigger events, or a response to actions taken by an organization or government. And it may be a setup for later attacks such as drive by compromise.
MITRE's examples include a group tied to defacing several Ukrainian organization websites, and a state linked group that defaced about 15,000 Georgian websites in 2019.
How to detect it
MITRE describes four analytics.
- General: changes to public web files such as HTML, JavaScript and CSS, often after a web shell, credential misuse or a web application exploit.
- Linux web servers: modified files resulting from upload flaws, remote code execution, or a replaced index page, possibly through SSH or a web shell.
- macOS: changes to web content through local development stacks or a misconfigured Apache.
- Cloud hosted sites: uploads of altered HTML or JavaScript through cloud consoles or APIs, such as object storage hosted sites.
MITRE names no log sources. Use file integrity monitoring on web roots, and audit logging on the storage account or bucket behind any static site. Compare deployed content against what your pipeline last released.
A defaced page may also carry script that targets visitors, so do not treat it as only an embarrassment.
How to reduce the risk
MITRE lists data backup. Keep backups off system, protected, and ready to restore. If your site is built from source, rebuild and redeploy from a known good commit instead of editing the live files.
Quick check
Why can defacement be more than reputational harm?
MITRE notes it can be a precursor to later attacks such as drive by compromise.
