AN1622
Analytic 1622
Windows
Adversary modifies externally-facing web content by accessing and overwriting hosted HTML/JS/CSS files, typically following web shell deployment, credential abuse, or exploitation of web application vulnerabilities.
WinEventLog:Security
EventCode=4663, 4670, 4656
NSM:Connections
Unusual POST requests to admin or upload endpoints
WinEventLog:Sysmon
EventCode=1
[target_directory]
Web root folder varies by environment, e.g., C:\inetpub\wwwroot
[UserContext]
May vary based on which service account hosts the website
[TimeWindow]
Time between webshell upload and file overwrite may vary
AN1623
Analytic 1623
Linux
Adversary compromises a Linux-based web server and modifies hosted web files by exploiting upload vulnerabilities, remote code execution, or replacing index.html via SSH/webshell.
auditd:SYSCALL
open/write syscalls targeting web directory files
NSM:Connections
Successful sudo or ssh from unknown IPs
NSM:Flow
Suspicious POSTs to upload endpoints
[web_root]
May differ (e.g., /var/www/html, /srv/http, etc.)
[payload_hash]
Adversary content hash may change across campaigns
[UserContext]
Can range from apache/nginx user to root if escalated
AN1624
Analytic 1624
macOS
Adversary modifies web-facing content on macOS via web development environments like MAMP or misconfigured Apache instances, typically with access to the hosting user account or via persistence tools.
macos:unifiedlog
Terminal/Editor processes modifying web folder
macos:unifiedlog
loginwindow or sshd events with external IP
[web_root_dir]
May include ~/Sites or custom Apache paths
[editor_name]
Text editor or script modifying the files may vary (e.g., nano, VS Code)
AN1625
Analytic 1625
IaaS
Adversary modifies content in cloud-hosted websites (e.g., AWS S3-backed, Azure Blob-hosted sites) by gaining access to management consoles or APIs and uploading altered HTML/JS files.
AWS:CloudTrail
PutObject
AWS:CloudTrail
ListBuckets
AWS:CloudTrail
GetObject, CopyObject
[bucket_name]
Website bucket name varies per org
[region]
Adversary may target multi-region failover setups
[IAMRole]
Attack may leverage stolen cross-account roles or elevated policies