Public Website Defacement via Compromised CMS Admin Session or Mass Static Asset Tampering

let EditWindow = 15m;
let MinEditCount = 8;
let MinFilesModified = 5;
let AdminPaths = dynamic(["/wp-admin/post.php", "/wp-admin/post-new.php", "/wp-admin/edit.php", "/wp-admin/theme-editor.php", "/wp-admin/customize.php", "/wp-json/wp/v2/pages", "/wp-json/wp/v2/posts", "/administrator/index.php", "/administrator/components/com_content", "/user/login", "/node/add", "/umbraco/backoffice", "/sitecore/shell"]);
let WebRootPaths = dynamic(["\\inetpub\\wwwroot\\", "\\wwwroot\\", "\\htdocs\\", "\\public_html\\", "/var/www/", "/usr/share/nginx/html/"]);
let WebAssetExtensions = dynamic([".html", ".htm", ".php", ".css", ".js", ".jpg", ".png", ".svg"]);
// Branch 1: burst of CMS admin content-edit requests from a single source IP, seen in WAF/reverse-proxy logs forwarded as CEF
let CmsAdminEditBurst = CommonSecurityLog
| where TimeGenerated > ago(2h)
| where RequestMethod in ("POST", "PUT")
| where RequestURL has_any (AdminPaths)
| summarize EditCount = count(), DistinctURLs = dcount(RequestURL), URLSample = make_set(RequestURL, 10) by SourceIP, DestinationHostName, bin(TimeGenerated, EditWindow)
| where EditCount >= MinEditCount
| extend DetectionType = "CmsAdminEditBurst", Severity = "High"
| project TimeGenerated, Actor = SourceIP, Target = DestinationHostName, Count = EditCount, DistinctItems = DistinctURLs, Sample = URLSample, DetectionType, Severity;
// Branch 2: mass direct modification of static web assets on the host filesystem, bypassing the CMS application layer entirely
let MassAssetTamper = DeviceFileEvents
| where TimeGenerated > ago(2h)
| where ActionType == "FileModified"
| where FolderPath has_any (WebRootPaths)
| where FileName has_any (WebAssetExtensions)
| where InitiatingProcessFileName !in~ ("svchost.exe", "TrustedInstaller.exe", "msiexec.exe", "WUDFHost.exe", "MicrosoftEdgeUpdate.exe")
| summarize FilesModified = dcount(FileName), FileSample = make_set(FileName, 10), Processes = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, EditWindow)
| where FilesModified >= MinFilesModified
| extend DetectionType = "MassStaticAssetTamper", Severity = "Critical"
| project TimeGenerated, Actor = InitiatingProcessAccountName, Target = DeviceName, Count = FilesModified, DistinctItems = FilesModified, Sample = FileSample, DetectionType, Severity;
CmsAdminEditBurst
| union MassAssetTamper
| sort by TimeGenerated desc

index=waf sourcetype=cef (method=POST OR method=PUT)
| eval AdminPath=if(like(request_url,"%/wp-admin/post.php%") OR like(request_url,"%/wp-admin/post-new.php%") OR like(request_url,"%/wp-admin/edit.php%") OR like(request_url,"%/wp-admin/theme-editor.php%") OR like(request_url,"%/wp-json/wp/v2/pages%") OR like(request_url,"%/wp-json/wp/v2/posts%") OR like(request_url,"%/administrator/index.php%") OR like(request_url,"%/administrator/components/com_content%") OR like(request_url,"%/node/add%") OR like(request_url,"%/umbraco/backoffice%") OR like(request_url,"%/sitecore/shell%"), 1, 0)
| where AdminPath=1
| bin _time span=15m
| stats count as EditCount, dc(request_url) as DistinctURLs, values(request_url) as URLSample by src_ip, dest_host, _time
| eval DetectionType="CmsAdminEditBurst", Severity="High"
| where EditCount >= 8
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (like(TargetFilename,"%\\inetpub\\wwwroot\\%") OR like(TargetFilename,"%\\wwwroot\\%") OR like(TargetFilename,"%\\htdocs\\%") OR like(TargetFilename,"%\\public_html\\%") OR like(TargetFilename,"%/var/www/%"))
      (like(TargetFilename,"%.html") OR like(TargetFilename,"%.htm") OR like(TargetFilename,"%.php") OR like(TargetFilename,"%.css") OR like(TargetFilename,"%.js") OR like(TargetFilename,"%.jpg") OR like(TargetFilename,"%.png") OR like(TargetFilename,"%.svg"))
      NOT (like(Image,"%\\svchost.exe") OR like(Image,"%\\TrustedInstaller.exe") OR like(Image,"%\\msiexec.exe"))
      | bin _time span=15m
      | stats dc(TargetFilename) as FilesModified, values(TargetFilename) as FileSample, values(Image) as Processes by host, User, _time
      | eval DetectionType="MassStaticAssetTamper", Severity="Critical"
      | where FilesModified >= 5 ]
| sort - _time

sequence by host.name, user.name with maxspan=15m
  [file where event.action == "modification" and file.path : ("*/var/www/*", "*wwwroot*", "*htdocs*", "*public_html*") and file.extension : ("html", "htm", "php", "css", "js", "jpg", "png", "svg")]
  [file where event.action == "modification" and file.path : ("*/var/www/*", "*wwwroot*", "*htdocs*", "*public_html*") and file.extension : ("html", "htm", "php", "css", "js", "jpg", "png", "svg")]
  [file where event.action == "modification" and file.path : ("*/var/www/*", "*wwwroot*", "*htdocs*", "*public_html*") and file.extension : ("html", "htm", "php", "css", "js", "jpg", "png", "svg")]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  URL AS RequestURL,
  "HTTP Method" AS Method
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%WAF%'
  AND "HTTP Method" IN ('POST', 'PUT')
  AND (URL ILIKE '%/wp-admin/post.php%' OR URL ILIKE '%/wp-json/wp/v2/posts%' OR URL ILIKE '%/administrator/index.php%' OR URL ILIKE '%/node/add%' OR URL ILIKE '%/umbraco/backoffice%')
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory="waf/access"
(method="POST" OR method="PUT")
| json field=_raw "request_url" as RequestURL nodrop
| json field=_raw "src_ip" as SourceIP nodrop
| where RequestURL matches "*/wp-admin/post*" or RequestURL matches "*/wp-json/wp/v2/posts*" or RequestURL matches "*/administrator/index.php*" or RequestURL matches "*/node/add*" or RequestURL matches "*/umbraco/backoffice*"
| timeslice 15m
| stats count as EditCount, dc(RequestURL) as DistinctURLs, values(RequestURL) as URLSample by SourceIP, _timeslice
| where DistinctURLs >= 8
| sort by DistinctURLs desc

rule public_website_defacement_admin_burst {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects a single source IP issuing a burst of CMS admin content-edit requests across many distinct URLs within a short window, consistent with scripted website defacement"
    reference = "https://attack.mitre.org/techniques/T1491/002/"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1491.002"
    false_positives = "Bulk editorial sessions, CI/CD deploys, CMS auto-updaters, marketing automation"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST" or $e.network.http.method = "PUT"
    $e.target.url = /(wp-admin\/post|wp-json\/wp\/v2\/posts|administrator\/index\.php|node\/add|umbraco\/backoffice)/
    $source_ip = $e.principal.ip
    $url = $e.target.url

  match:
    $source_ip over 15m

  outcome:
    $distinct_urls = count_distinct($url)

  condition:
    $e and $distinct_urls >= 8
}

#repo=waf_logs
method=/^(POST|PUT)$/
request_url=/(wp-admin\/post|wp-json\/wp\/v2\/posts|administrator\/index\.php|node\/add|umbraco\/backoffice)/
| groupBy([src_ip], function=[count(as=EditCount), distinct(request_url, as=DistinctURLs), collect(request_url, limit=20, as=URLSample)])
| test(DistinctURLs >= 8)
| sort(DistinctURLs, order=desc)