MITRE ATT&CKtechnique
T1491 Defacement
- Domain
- enterprise
- Tactics
- Impact
- Platforms
- Windows, IaaS, Linux, macOS, ESXi
- Version
- 1.5
- Created
- 2019-04-08
Description
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Related
Tactic · MITRE ATT&CK (1)
- TA0040 Impact tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1053 Data Backup mitigation
Referenced by MITRE ATT&CK · subtechnique of (2)
Referenced by CAPEC · att&ck technique (1)
- CAPEC-148 Content Spoofing attack pattern
Referenced by Compliance · mitigates (13)
- CIS-11.2 Perform Automated Backups CIS Safeguard v8.1
- CIS-11.3 Protect Recovery Data CIS Safeguard v8.1
- CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS Safeguard v8.1
- NIST-AC-3 Access Enforcement NIST 800-53 control
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
- NIST-CP-2 Contingency Plan NIST 800-53 control
- NIST-CP-7 Alternate Processing Site NIST 800-53 control
- NIST-CP-9 System Backup NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
References
- https://www.hkcert.org/blog/defacement-attacks-understanding-and-prevention Defacement Attacks