Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-PublicWebsiteDefacement.
Upgrade to ProDetect Public Website Defacement via Compromised CMS Admin Session or Mass Static Asset Tampering in Google Chronicle
Adversaries who obtain stolen CMS administrator credentials or exploit an unpatched plugin/theme vulnerability on a public-facing content management system (WordPress, Joomla, Drupal, Umbraco, Sitecore, etc.) frequently pivot straight to defacing the site — replacing the homepage, posting propaganda content, or mass-editing pages — to deliver a political message, claim credit, or intimidate the target organization. This pattern shows up in two complementary ways depending on the compromise vector: (1) a burst of authenticated content-edit HTTP requests (POST/PUT to admin post/page/theme-editor endpoints) from a single source IP or session hitting many distinct URLs in a short window, captured in WAF or reverse-proxy access logs, which is characteristic of a scripted mass-edit rather than a human editor working through the admin UI one page at a time; and (2) direct filesystem tampering where an attacker who has RCE (via a vulnerable plugin, exposed file manager, or stolen SFTP/SSH credentials) bypasses the CMS application layer entirely and mass-modifies static HTML, PHP, CSS, JS, and image assets directly in the web root, captured via endpoint file-monitoring telemetry. Both paths differ sharply from routine content operations: legitimate CMS editors and CI/CD deployment pipelines touch a handful of pages per session or deploy through a recognized service account/process, not dozens of distinct admin endpoints or web-root files from a single caller within minutes. Detection correlates a distinct-URL or distinct-file count threshold within a short burst window against the initiating source IP, session, or account to separate scripted mass defacement from normal editorial and deployment activity.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule public_website_defacement_admin_burst {
meta:
author = "df00tech Detection Engineering"
description = "Detects a single source IP issuing a burst of CMS admin content-edit requests across many distinct URLs within a short window, consistent with scripted website defacement"
reference = "https://attack.mitre.org/techniques/T1491/002/"
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1491.002"
false_positives = "Bulk editorial sessions, CI/CD deploys, CMS auto-updaters, marketing automation"
version = "1.0"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.network.http.method = "POST" or $e.network.http.method = "PUT"
$e.target.url = /(wp-admin\/post|wp-json\/wp\/v2\/posts|administrator\/index\.php|node\/add|umbraco\/backoffice)/
$source_ip = $e.principal.ip
$url = $e.target.url
match:
$source_ip over 15m
outcome:
$distinct_urls = count_distinct($url)
condition:
$e and $distinct_urls >= 8
}Chronicle YARA-L 2.0 rule matching NETWORK_HTTP UDM events for POST/PUT requests to CMS admin content-edit endpoints, grouped by source IP over a 15-minute match window. Fires when the same source IP hits 8 or more distinct admin URLs. Pair with a companion rule over FILE_MODIFICATION UDM events (event_type = 'FILE_MODIFICATION', target.file.full_path matching web root paths) grouped by principal.user.userid, firing on 5 or more distinct target.file.full_path values within the same window, to cover the filesystem-layer defacement branch.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate content editors performing bulk edits during a scheduled content migration or campaign refresh
- CI/CD deployment agents pushing an updated site build to the web root as part of a normal release
- CMS auto-update processes rewriting many files during a scheduled update window
- Marketing/SEO automation tools bulk-updating content across many pages via the CMS REST API
Other platforms for THREAT-Impact-PublicWebsiteDefacement
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Burst of CMS Admin Content-Edit Requests
Expected signal: WAF/reverse-proxy access logs (CommonSecurityLog) showing 10 POST requests to /wp-admin/post.php from the test source IP within a few minutes, targeting 10 distinct post IDs.
- Test 2Simulate Mass Static Asset Tampering on Web Root (Linux)
Expected signal: File-modification events (Sysmon Event ID 11 / auditd) for 6 distinct files under /tmp/atomictest-webroot within seconds of each other, written by a shell process.
- Test 3Simulate Mass Static Asset Tampering on IIS Web Root (Windows)
Expected signal: MDE DeviceFileEvents / Sysmon Event ID 11 entries for 5 distinct files under C:\atomictest\wwwroot within seconds, with InitiatingProcessFileName = powershell.exe.
References (6)
- https://attack.mitre.org/techniques/T1491/002/
- https://attack.mitre.org/techniques/T1491/
- https://attack.mitre.org/tactics/TA0040/
- https://owasp.org/www-community/attacks/Content_Spoofing
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1491.002/T1491.002.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-PublicWebsiteDefacement — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month