Defacement
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0662 (Windows) is the same web-root/file-write shape as the published T1491.001 -- that rule's own false-positives already name \inetpub\wwwroot writes as an expected match, so a parent-level rule on the same path and file types would re-detect the identical event under a broader target_filenames knob, not add a distinct observable. AN0663 (Linux) offers only an auditd 'write' syscall, whose SYSCALL record carries no filename -- that lives in the paired PATH record, which the brief gives no field for -- plus a syslog leg keyed on 'unauthorized sudo or shell access', an access-anomaly judgment that belongs to privilege-escalation and valid-account techniques, not to defacement specifically. AN0664 (macOS) is unifiedlog prose with no Sigma field vocabulary. No parent-level observable distinct from T1491.001 remains once its Windows leg is set aside.
Covered instead by T1491.001.
What the technique is
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0662
Adversary modifies website or application-hosted content via unauthorized file changes or script injections, often by exploiting web servers or CMS access.
- AN0663
Adversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.
- AN0664
Adversary modifies internal or external site content through manipulated application bundles, hosted content, or web server configs.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.