T1491.002No distinct observable

External Defacement

ImpactWindows, IaaS, Linux, macOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

What separates External from Internal Defacement is whether the defaced site faces the Internet -- a property of network exposure that appears in no field of any log source in this brief, so no telemetry here distinguishes T1491.002 from the already-published T1491.001. Concretely: AN1622's Windows file_event leg is a content write under the IIS web root, and the T1491.001 rule already selects TargetFilename|contains '\inetpub\wwwroot\' and names ordinary publishing to that path among its own false positives, so a rule here would match the identical Sysmon EventID 11 events under a broader target_directory knob. […]

Covered instead by T1491.001, T1491.

What the technique is

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda. External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.

Read it on attack.mitre.org

What MITRE says you would watch

AN1622
Adversary modifies externally-facing web content by accessing and overwriting hosted HTML/JS/CSS files, typically following web shell deployment, credential abuse, or exploitation of web application vulnerabilities.
AN1623
Adversary compromises a Linux-based web server and modifies hosted web files by exploiting upload vulnerabilities, remote code execution, or replacing index.html via SSH/webshell.
AN1624
Adversary modifies web-facing content on macOS via web development environments like MAMP or misconfigured Apache instances, typically with access to the hosting user account or via persistence tools.