T1491 — Defacement

# T1491 - Defacement

## SOC Recommendation
Investigate Defacement activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Resource Access Mediation | Isolate | Apply Network Resource Access Mediation to contain the blast radius once this technique is observed. |
| Decoy Network Resource | Deceive | Deploy Decoy Network Resource to detect and mislead an adversary attempting this technique. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let lookback = 1h;
let suspiciousPageNames = dynamic(["home.aspx", "default.aspx", "index.aspx", "sitepage", "landing", "portal", "homepage"]);
let suspiciousContentTerms = dynamic(["hacked", "defaced", "owned", "pwned", "pay ransom", "ransomware", "bitcoin", "monero"]);
let officeActivitySource =
    union isfuzzy=true OfficeActivity,
    (datatable(TimeGenerated:datetime, OfficeWorkload:string, Operation:string, UserId:string, ClientIP:string, Site_Url:string, SourceFileName:string, ObjectId:string, UserAgent:string, ModifiedProperties:string)[]);
officeActivitySource
| where TimeGenerated >= ago(lookback)
| where OfficeWorkload in~ ("SharePoint", "OneDrive")
| where Operation in~ ("FileModified", "FileUploaded", "PageModified", "SitePageModified", "FileRenamed")
| extend FileName = tolower(tostring(coalesce(SourceFileName, ObjectId))),
         ModifiedText = tolower(tostring(ModifiedProperties)),
         UserPrincipalName = tolower(tostring(UserId))
| where FileName has_any (suspiciousPageNames) or ModifiedText has_any (suspiciousContentTerms)
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    ModifiedObjects = make_set(ObjectId, 25),
    FileNames = make_set(FileName, 25),
    ClientIPs = make_set(ClientIP, 10),
    UserAgents = make_set(UserAgent, 10),
    OperationCount = count()
    by UserPrincipalName, SiteUrl = tostring(Site_Url)
| extend TimeGenerated = LastSeen,
         timestamp = LastSeen,
         AccountCustomEntity = UserPrincipalName,
         URLCustomEntity = SiteUrl
| order by OperationCount desc, LastSeen desc
```
```kql
let lookback = 1h;
let suspiciousWebPaths = dynamic(["/admin", "/upload", "/editor", "/wp-admin", "/cms", "/api/content"]);
let approvedDeploymentTools = dynamic(["msdeploy.exe", "git.exe", "runner.exe", "octopus.tentacle.exe", "kudu.exe", "zipdeploy.exe"]);
let suspiciousWrites =
    DeviceFileEvents
    | where TimeGenerated >= ago(lookback)
    | where FolderPath has_any ("\\inetpub\\wwwroot", "\\wwwroot", "\\public_html", "\\htdocs", "\\site\\wwwroot")
    | where ActionType in~ ("FileModified", "FileCreated", "FileRenamed")
    | where InitiatingProcessFileName !in~ (approvedDeploymentTools)
    | project DeviceName, WriteTime = TimeGenerated, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let suspiciousInbound =
    W3CIISLog
    | where TimeGenerated >= ago(lookback)
    | where csMethod in~ ("POST", "PUT", "PATCH")
    | where csUriStem has_any (suspiciousWebPaths)
    | project DeviceName = sComputerName, RequestTime = TimeGenerated, SrcIP = cIP, csMethod, csUriStem, csUserName;
suspiciousWrites
| join kind=leftouter suspiciousInbound on DeviceName
| where isnull(RequestTime) or abs(datetime_diff("minute", WriteTime, RequestTime)) <= 10
| project TimeGenerated = coalesce(RequestTime, WriteTime), DeviceName, SrcIP, csMethod, csUriStem, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         IPCustomEntity = SrcIP,
         AccountCustomEntity = InitiatingProcessAccountName
| order by TimeGenerated desc
```
```kql
let timeframe = 24h;
BitSightAlerts
| where ingestion_time() > ago(timeframe)
| extend Severity = case( Severity contains "INCREASE", "Low",
                          Severity contains "WARN" or Severity contains "DECREASE", "Medium",
                          Severity contains "CRITICAL", "High",
                          "Informational")
| extend CompanyURL = strcat("https://service.bitsighttech.com/app/spm",CompanyURL)
| project CompanyName, Severity, Trigger, CompanyURL, AlertDate, GUID
```

## Escalation Criteria
- Defacement activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1491.json
• /api/recommendations/T1491.json
• /api/d3fend/T1491.json
• /api/mappings/T1491.json
• /api/confluence/T1491.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1491.json

Response:

{
  "technique_id": "T1491",
  "name": "Defacement",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "Windows",
    "IaaS",
    "Linux",
    "macOS",
    "ESXi"
  ],
  "summary": "Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion...",
  "soc_recommendation": "Investigate Defacement activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NRAM",
      "name": "Network Resource Access Mediation",
      "relationship": "isolate",
      "practical_action": "Apply Network Resource Access Mediation to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-DNR",
      "name": "Decoy Network Resource",
      "relationship": "deceive",
      "practical_action": "Deploy Decoy Network Resource to detect and mislead an adversary attempting this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed defacement activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"SharePoint Site Page Defacement\" -- Detects suspicious modification of SharePoint/OneDrive site pages and public content, complementing IM-012's external web-root/IIS defacement coverage."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-IM-005 — SharePoint Site Page Defacement",
        "description": "Detects suspicious modification of SharePoint/OneDrive site pages and public content, complementing IM-012's external web-root/IIS defacement coverage. (Source: Bell Integration baseline detection library, mapped via sub-technique T1491.001.)",
        "query": "let lookback = 1h;\nlet suspiciousPageNames = dynamic([\"home.aspx\", \"default.aspx\", \"index.aspx\", \"sitepage\", \"landing\", \"portal\", \"homepage\"]);\nlet suspiciousContentTerms = dynamic([\"hacked\", \"defaced\", \"owned\", \"pwned\", \"pay ransom\", \"ransomware\", \"bitcoin\", \"monero\"]);\nlet officeActivitySource =\n    union isfuzzy=true OfficeActivity,\n    (datatable(TimeGenerated:datetime, OfficeWorkload:string, Operation:string, UserId:string, ClientIP:string, Site_Url:string, SourceFileName:string, ObjectId:string, UserAgent:string, ModifiedProperties:string)[]);\nofficeActivitySource\n| where TimeGenerated >= ago(lookback)\n| where OfficeWorkload in~ (\"SharePoint\", \"OneDrive\")\n| where Operation in~ (\"FileModified\", \"FileUploaded\", \"PageModified\", \"SitePageModified\", \"FileRenamed\")\n| extend FileName = tolower(tostring(coalesce(SourceFileName, ObjectId))),\n         ModifiedText = tolower(tostring(ModifiedProperties)),\n         UserPrincipalName = tolower(tostring(UserId))\n| where FileName has_any (suspiciousPageNames) or ModifiedText has_any (suspiciousContentTerms)\n| summarize\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated),\n    ModifiedObjects = make_set(ObjectId, 25),\n    FileNames = make_set(FileName, 25),\n    ClientIPs = make_set(ClientIP, 10),\n    UserAgents = make_set(UserAgent, 10),\n    OperationCount = count()\n    by UserPrincipalName, SiteUrl = tostring(Site_Url)\n| extend TimeGenerated = LastSeen,\n         timestamp = LastSeen,\n         AccountCustomEntity = UserPrincipalName,\n         URLCustomEntity = SiteUrl\n| order by OperationCount desc, LastSeen desc"
      },
      {
        "name": "GEN-IM-012 — External Website Defacement via Web-Root Write",
        "description": "Detects writes to external web roots, optionally correlated with inbound upload/admin requests. This complements IM-005's SharePoint page defacement. (Source: Bell Integration baseline detection library, mapped via sub-technique T1491.002.)",
        "query": "let lookback = 1h;\nlet suspiciousWebPaths = dynamic([\"/admin\", \"/upload\", \"/editor\", \"/wp-admin\", \"/cms\", \"/api/content\"]);\nlet approvedDeploymentTools = dynamic([\"msdeploy.exe\", \"git.exe\", \"runner.exe\", \"octopus.tentacle.exe\", \"kudu.exe\", \"zipdeploy.exe\"]);\nlet suspiciousWrites =\n    DeviceFileEvents\n    | where TimeGenerated >= ago(lookback)\n    | where FolderPath has_any (\"\\\\inetpub\\\\wwwroot\", \"\\\\wwwroot\", \"\\\\public_html\", \"\\\\htdocs\", \"\\\\site\\\\wwwroot\")\n    | where ActionType in~ (\"FileModified\", \"FileCreated\", \"FileRenamed\")\n    | where InitiatingProcessFileName !in~ (approvedDeploymentTools)\n    | project DeviceName, WriteTime = TimeGenerated, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;\nlet suspiciousInbound =\n    W3CIISLog\n    | where TimeGenerated >= ago(lookback)\n    | where csMethod in~ (\"POST\", \"PUT\", \"PATCH\")\n    | where csUriStem has_any (suspiciousWebPaths)\n    | project DeviceName = sComputerName, RequestTime = TimeGenerated, SrcIP = cIP, csMethod, csUriStem, csUserName;\nsuspiciousWrites\n| join kind=leftouter suspiciousInbound on DeviceName\n| where isnull(RequestTime) or abs(datetime_diff(\"minute\", WriteTime, RequestTime)) <= 10\n| project TimeGenerated = coalesce(RequestTime, WriteTime), DeviceName, SrcIP, csMethod, csUriStem, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         IPCustomEntity = SrcIP,\n         AccountCustomEntity = InitiatingProcessAccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "a1275c5e-0ff4-4d15-a7b7-96018cd979f5 — BitSight - new alert found",
        "description": "Rule helps to detect a new alerts generated in BitSight.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let timeframe = 24h;\nBitSightAlerts\n| where ingestion_time() > ago(timeframe)\n| extend Severity = case( Severity contains \"INCREASE\", \"Low\",\n                          Severity contains \"WARN\" or Severity contains \"DECREASE\", \"Medium\",\n                          Severity contains \"CRITICAL\", \"High\",\n                          \"Informational\")\n| extend CompanyURL = strcat(\"https://service.bitsighttech.com/app/spm\",CompanyURL)\n| project CompanyName, Severity, Trigger, CompanyURL, AlertDate, GUID"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "16acac42-b2f9-4802-9290-d6c30914db6e — AWS S3 Static Site JavaScript File Uploaded",
        "description": "(ESQL) This rule detects when a JavaScript file is uploaded in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-aws.cloudtrail* metadata _id, _version, _index\n\n| where\n    // S3 object write activity\n    data_stream.dataset == \"aws.cloudtrail\"\n    and event.provider == \"s3.amazonaws.com\"\n    and event.action == \"PutObject\"\n    and event.outcome == \"success\"\n\n    // IAM users or assumed roles only\n    and aws.cloudtrail.user_identity.type in (\"IAMUser\", \"AssumedRole\")\n\n    // Requests for static site bundles\n    and aws.cloudtrail.request_parameters like \"*static/js/*.js*\"\n\n    // Exclude IaC and automation tools\n    and not (\n        user_agent.original like \"*Terraform*\"\n        or user_agent.original like \"*Ansible*\"\n        or user_agent.original like \"*Pulumi*\"\n    )\n\n// Extract fields from request parameters\n| dissect aws.cloudtrail.request_parameters\n    \"%{{?bucket.name.key}=%{Esql.aws_cloudtrail_request_parameters_bucket_name}, %{?host.key}=%{Esql_priv.aws_cloudtrail_request_parameters_host}, %{?bucket.object.location.key}=%{Esql.aws_cloudtrail_request_parameters_bucket_object_location}}\"\n\n// Extract file name portion from full object path\n| dissect Esql.aws_cloudtrail_request_parameters_bucket_object_location \"%{}static/js/%{Esql.aws_cloudtrail_request_parameters_object_key}\"\n\n// Match on JavaScript files\n| where ends_with(Esql.aws_cloudtrail_request_parameters_object_key, \".js\")\n\n// Retain relevant ECS and dissected fields\n| keep\n    aws.cloudtrail.user_identity.arn,\n    aws.cloudtrail.user_identity.access_key_id,\n    aws.cloudtrail.user_identity.type,\n    aws.cloudtrail.request_parameters,\n    Esql.aws_cloudtrail_request_parameters_bucket_name,\n    Esql.aws_cloudtrail_request_parameters_object_key,\n    user_agent.original,\n    source.ip,\n    event.action,\n    @timestamp,\n    _id,\n    _version,\n    _index"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Defacement activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1491 - Defacement Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}