MITRE ATT&CKsub-technique

T1491.002 External Defacement

Published 2020-02-20 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
Windows, IaaS, Linux, macOS
Version
1.2
Created
2020-02-20

Description

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda. External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1491 Defacement technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1053 Data Backup mitigation

Referenced by MITRE ATT&CK · uses (2)

Referenced by Compliance · mitigates (13)

  • CIS-11.2 Perform Automated Backups CIS Safeguard v8.1
  • CIS-11.3 Protect Recovery Data CIS Safeguard v8.1
  • CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References