Detect Defacement in Splunk
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as part of defacement to cause user discomfort or to pressure compliance with accompanying messages. Internal defacement targets assets visible within an enterprise (desktop wallpapers, screensavers, logon banners), while external defacement targets publicly accessible web content (web server root files, CMS templates, hosted images).
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1491 Defacement
- Canonical reference
- https://attack.mitre.org/techniques/T1491/
SPL Detection Query
| union
[ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval FolderPath=lower(TargetFilename)
| where match(FolderPath, "(\\\\inetpub\\\\wwwroot|\\\\htdocs|\\\\public_html|\\\\nginx\\\\html|\/var\/www\/|\/srv\/http\/|\/usr\/share\/nginx)")
| where match(FolderPath, "\.(html|htm|php|asp|aspx|jsp|js|css|png|jpg|gif|svg|ico)$")
| eval InitProc=lower(Image)
| where match(InitProc, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|curl\.exe|wget\.exe|certutil\.exe|python\.exe|bash|sh)")
| eval DefacementType="WebFileModification"
| eval User=coalesce(User, "unknown")
| table _time, host, User, Image, CommandLine, TargetFilename, DefacementType ],
[ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12, 13, 14)
| eval RegPath=lower(TargetObject)
| where match(RegPath, "(\\\\control panel\\\\desktop|\\\\terminal server\\\\winlogon|\\\\windows nt\\\\currentversion\\\\winlogon|\\\\policies\\\\microsoft\\\\windows\\\\personalization)")
| where match(RegPath, "(wallpaper|screensaveactive|scrnsave\.exe|legalnoticecaption|legalnoticetext)")
| eval InitProc=lower(Image)
| where match(InitProc, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python\.exe|bash|sh)")
| eval DefacementType="RegistryWallpaperChange"
| eval User=coalesce(User, "unknown")
| table _time, host, User, Image, CommandLine, TargetObject, Details, DefacementType ],
[ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentProc=lower(ParentImage)
| eval ChildProc=lower(Image)
| where match(ParentProc, "(w3wp\.exe|nginx\.exe|httpd\.exe|apache2|tomcat)")
| where match(ChildProc, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|bash|sh|python\.exe)")
| eval DefacementType="WebServerShellSpawn"
| eval User=coalesce(User, "unknown")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DefacementType ]
| eval SeverityScore=case(
DefacementType="WebServerShellSpawn", 3,
DefacementType="WebFileModification", 2,
DefacementType="RegistryWallpaperChange", 1,
true(), 1)
| sort - SeverityScore, - _timeDetects defacement activity across three branches using Sysmon operational logs. Branch 1 uses Event ID 11 (FileCreate) to catch shells and scripting engines writing web content files (HTML, PHP, ASP, JSP, CSS) directly into web root directories. Branch 2 uses Event IDs 12/13/14 (Registry create/set/delete) to identify suspicious modification of Windows wallpaper and logon banner registry keys used in internal defacement. Branch 3 uses Event ID 1 (Process Create) to detect web server processes (IIS w3wp, nginx, Apache) spawning command shells — a strong indicator of web shell execution that often precedes or constitutes defacement. Results are ranked by a SeverityScore with web shell spawns rated highest.
Data Sources
Required Sourcetypes
False Positives & Tuning
- CI/CD deployment pipelines using shell commands to deploy web content updates to web root directories
- Administrative scripts updating default IIS or Apache landing pages during server provisioning
- Centralized IT management tools modifying corporate wallpaper and logon banners via Group Policy or Intune
- Web application frameworks (Django, Rails, Node.js) spawning shell processes for asset compilation or task runners
- Security scanning tools or web application firewalls writing logs or configuration files to web directories
Other platforms for T1491
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Replace Web Server Default Page (Windows IIS)
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename=C:\inetpub\wwwroot\index.html, Image=cmd.exe. DeviceFileEvents: ActionType=FileModified, FolderPath contains \wwwroot\, InitiatingProcessFileName=cmd.exe. Security Event ID 4663 (if object access auditing enabled on wwwroot directory).
- Test 2Internal Defacement via Wallpaper Registry Modification
Expected signal: Sysmon Event ID 13: RegistryValueSet with TargetObject=HKCU\Control Panel\Desktop\Wallpaper, Details=C:\Windows\Temp\defaced_wallpaper.jpg, Image=powershell.exe. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryKey contains Control Panel\Desktop, RegistryValueName=Wallpaper, InitiatingProcessFileName=powershell.exe.
- Test 3Web Shell Simulation — Web Server Spawning Command Shell
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe, CommandLine containing 'whoami'. DeviceProcessEvents: FileName=cmd.exe, InitiatingProcessFileName=powershell.exe. File creation event for webshell-test.txt.
- Test 4Linux Web Root File Replacement via Bash
Expected signal: Linux auditd: syscall=openat with path=/var/www/html/index.html and WRITE flag, uid/euid of calling user. Sysmon for Linux Event ID 11: FileCreate with TargetFilename=/var/www/html/index.html, Image=/usr/bin/bash. Linux file integrity monitoring (FIM) alert on /var/www/html/ if configured.
- Test 5Mass Internal Defacement via Logon Banner Registry Modification
Expected signal: Sysmon Event ID 13: RegistryValueSet with TargetObject=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption and LegalNoticeText, Image=reg.exe. Security Event ID 4657 (Registry value modified) if object access auditing is enabled on the Winlogon key. DeviceRegistryEvents: ActionType=RegistryValueSet, RegistryValueName=LegalNoticeCaption/LegalNoticeText.
References (10)
- https://attack.mitre.org/techniques/T1491/
- https://attack.mitre.org/techniques/T1491/001/
- https://attack.mitre.org/techniques/T1491/002/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1491/T1491.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
- https://www.sans.org/white-papers/web-application-defacement-detection/
Unlock Pro Content
Get the full detection package for T1491 including response playbook, investigation guide, and atomic red team tests.