AN0662
Analytic 0662
Windows
Adversary modifies website or application-hosted content via unauthorized file changes or script injections, often by exploiting web servers or CMS access.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=1
WinEventLog:Application
Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files
[target_filenames]
Environment-specific naming of defacement-prone files like 'index.html', 'main.css', 'app.js'.
[TimeWindow]
Detection based on rapid sequence of file writes and script injections within short time intervals.
AN0663
Analytic 0663
Linux
Adversary gains shell access or uploads a malicious script to deface hosted web content in Nginx, Apache, or other services.
auditd:SYSCALL
write
apache:access_log
Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders
linux:syslog
Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http
[UploadPathRegex]
Regex for CMS-specific upload directories subject to defacement (e.g., wp-content/uploads).
[FileExtensionScope]
Types of files to monitor for defacement (e.g., .html, .php, .jsp).
AN0664
Analytic 0664
macOS
Adversary modifies internal or external site content through manipulated application bundles, hosted content, or web server configs.
macos:unifiedlog
Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents
macos:unifiedlog
File creation or overwrite in common web-hosting folders
[TargetDirectoryPath]
Web root folders will vary depending on how services are configured on macOS (e.g., /Library/WebServer/Documents).
AN0665
Analytic 0665
ESXi
Adversary defaces internal VM-hosted portals or web UIs by modifying static content on datastore-mounted paths.
esxi:vmkernel
Unauthorized file modifications within datastore volumes via shell access or vCLI
[DatastoreVolumeName]
Each environment’s VMFS/volume mounts will vary in name and path.
AN0666
Analytic 0666
IaaS
Adversary uses compromised instance credentials or web application access to deface content hosted in S3 buckets, Azure Blob Storage, or GCP Buckets.
CloudTrail:PutObject
PutObject
AWS:CloudTrail
GetObject, CopyObject
[BucketNameRegex]
Patterns of S3 or GCP buckets used for static website hosting may vary by organization.
[IAMRoleContext]
Some uploads may appear benign unless enriched with user/role metadata.