T1491, Defacement, is the modification of visual content available inside or outside an enterprise network, which affects the integrity of the original content. MITRE files it under impact. Platforms are Windows, IaaS, Linux, macOS and ESXi. It has two sub techniques, internal defacement (T1491.001) and external defacement (T1491.002).
How attackers use it
MITRE lists the reasons: delivering a message, intimidation, or claiming, possibly falsely, credit for an intrusion. Disturbing or offensive images may be used to make users uncomfortable or to pressure them to comply with a message.
Defacement is rarely subtle, so the interesting question for defenders is how the attacker got write access to content in the first place.
How to detect it
MITRE's detection strategy covers five areas.
- Unauthorized file changes or script injections that alter website or application content, often after a web server or CMS is exploited.
- Shell access or uploaded malicious scripts on web servers such as Nginx or Apache.
- Altered application bundles, hosted content or web server configuration.
- Changes to static content on datastore mounted paths, which can deface internal VM hosted portals.
- Use of compromised instance credentials or web application access to modify content in cloud storage buckets such as S3, Azure Blob Storage and GCP buckets.
MITRE names no log sources. File integrity monitoring on web roots, change logging on storage buckets and web server access logs for unexpected uploads cover most of it.
How to reduce the risk
MITRE lists one mitigation: data backup. Keep disaster recovery plans with regular backups, stored off system and protected from the methods adversaries use to reach and destroy them. A clean copy of site content turns a defacement into a short restore.
Also keep deployment automated, so that a known good version can be pushed again quickly.
Quick check
What is the main mitigation MITRE lists for defacement?
Data backup, with copies stored off system and protected from adversary access.
