Defacement: External Defacement T1491.002

Tactic: Impact

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda. External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Esql.aws_cloudtrail_request_parameters_object_key1ends_with 1.js
EventType1eq 1putobject
Provider_Name1eq 1s3.amazonaws.com
aws::requestParameters1wildcard 1*static/js/*.js*
aws::userIdentity.type1in 1assumedrole, iamuser
data_stream.dataset1eq 1aws.cloudtrail
event.outcome1eq 1success

Top indicator values (8 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Esql.aws_cloudtrail_request_parameters_object_keyends_with
.js
1
EventTypeeq
putobject
1
Provider_Nameeq
s3.amazonaws.com
115
aws::requestParameterswildcard
*static/js/*.js*
1
aws::userIdentity.typein
assumedrole
1
aws::userIdentity.typein
iamuser
12
data_stream.dataseteq
aws.cloudtrail
1173
event.outcomeeq
success
1375

Exclusions (3 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentcontains
ansible
1
aws::userAgentcontains
pulumi
1
aws::userAgentcontains
terraform
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 1 rule