Website Defacement — Unauthorized Web Root and CMS Content Tampering

// THREAT: Website Defacement - Web Root Tampering + CMS Admin Content Publish Anomaly
// Requires DeviceFileEvents (MDE) for the web-root signal and a CMS/web app log table (here modeled as a generic 'CMSAuditLogs_CL' custom log) for the admin-publish signal
let LookbackWindow = 24h;
let HomepageFileNames = dynamic(["index.html", "index.php", "index.htm", "default.aspx", "default.asp", "home.html", "wp-config.php"]);
let KnownDeployProcesses = dynamic(["msbuild.exe", "dotnet.exe", "git.exe", "rsync", "scp", "w3wp.exe", "kuduexecutable.exe", "docker.exe"]);
// Signal 1: homepage/critical file written to a web-exposed directory by an unexpected process
let WebRootTamper = DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has_any ("\\wwwroot\\", "\\htdocs\\", "\\inetpub\\", "/var/www/", "/usr/share/nginx/")
| where FileName in~ (HomepageFileNames)
| where InitiatingProcessFileName !in~ (KnownDeployProcesses)
| project Timestamp, DeviceName, FileName, FolderPath, ActionType,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend Indicator = "WebRootHomepageTamperedByUnexpectedProcess"
| extend RiskScore = 90;
// Signal 2: CMS admin authentication immediately followed by a content-publish action from a source IP never seen before for that account (requires a CMS audit log ingested as CMSAuditLogs_CL)
let PriorIPsPerAccount = CMSAuditLogs_CL
| where TimeGenerated between (ago(90d) .. ago(LookbackWindow))
| where Action_s in ("login_success", "admin_login")
| summarize KnownSourceIPs = make_set(SourceIP_s) by AdminAccount_s;
let AdminPublishAnomaly = CMSAuditLogs_CL
| where TimeGenerated > ago(LookbackWindow)
| where Action_s in ("login_success", "admin_login")
| join kind=inner (
    CMSAuditLogs_CL
    | where TimeGenerated > ago(LookbackWindow)
    | where Action_s in ("publish_post", "update_page", "edit_theme_file", "plugin_install")
  ) on AdminAccount_s
| where TimeGenerated1 - TimeGenerated between (0min .. 30min)
| lookup PriorIPsPerAccount on AdminAccount_s
| where KnownSourceIPs !has SourceIP_s
| project TimeGenerated, AdminAccount_s, SourceIP_s, Action_s1, KnownSourceIPs
| extend Indicator = "CMSAdminPublishFromNeverSeenSourceIP"
| extend RiskScore = 75;
union WebRootTamper, AdminPublishAnomaly
| sort by RiskScore desc, Timestamp desc

(
  index=mde sourcetype="DeviceFileEvents"
  ActionType IN ("FileCreated","FileModified","FileRenamed")
  (FolderPath="*\\wwwroot\\*" OR FolderPath="*\\htdocs\\*" OR FolderPath="*\\inetpub\\*" OR FolderPath="*/var/www/*" OR FolderPath="*/usr/share/nginx/*")
  FileName IN ("index.html","index.php","index.htm","default.aspx","default.asp","home.html","wp-config.php")
  NOT InitiatingProcessFileName IN ("msbuild.exe","dotnet.exe","git.exe","rsync","scp","w3wp.exe","kuduexecutable.exe","docker.exe")
)
| eval Indicator="WebRootHomepageTamperedByUnexpectedProcess", RiskScore=90
| table _time, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, Indicator, RiskScore
| append [
    search index=cms sourcetype="cms:audit" Action IN ("publish_post","update_page","edit_theme_file","plugin_install")
    | rename AdminAccount as AdminAccount_publish, SourceIP as SourceIP_publish
    | join type=inner AdminAccount_publish
        [ search index=cms sourcetype="cms:audit" Action IN ("login_success","admin_login") earliest=-90d
          | stats values(SourceIP) AS KnownSourceIPs by AdminAccount
          | rename AdminAccount as AdminAccount_publish ]
    | where NOT mvfind(KnownSourceIPs, SourceIP_publish) >= 0
    | eval Indicator="CMSAdminPublishFromNeverSeenSourceIP", RiskScore=75
    | table _time, AdminAccount_publish, SourceIP_publish, Action, KnownSourceIPs, Indicator, RiskScore
  ]
| sort - RiskScore

any where event.category == "file" and event.type in ("creation", "change", "rename") and (
  file.path : ("*wwwroot*", "*htdocs*", "*inetpub*", "*/var/www/*", "*/usr/share/nginx/*") and
  file.name : ("index.html", "index.php", "index.htm", "default.aspx", "default.asp", "home.html", "wp-config.php") and
  not process.name : ("msbuild.exe", "dotnet.exe", "git.exe", "rsync", "scp", "w3wp.exe", "docker.exe")
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  devicename AS ComputerName,
  filename AS FileName,
  UTF8(payload) AS RawEvent
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 350)
  AND (
    UTF8(payload) ILIKE '%wwwroot%' OR UTF8(payload) ILIKE '%htdocs%'
    OR UTF8(payload) ILIKE '%inetpub%' OR UTF8(payload) ILIKE '%/var/www/%'
  )
  AND (
    UTF8(payload) ILIKE '%index.html%' OR UTF8(payload) ILIKE '%index.php%'
    OR UTF8(payload) ILIKE '%default.aspx%' OR UTF8(payload) ILIKE '%wp-config.php%'
  )
  AND NOT (
    UTF8(payload) ILIKE '%msbuild.exe%' OR UTF8(payload) ILIKE '%dotnet.exe%'
    OR UTF8(payload) ILIKE '%git.exe%' OR UTF8(payload) ILIKE '%w3wp.exe%'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=*/FIM* OR _sourceCategory=*/Windows/Sysmon*
| where (%"EventID" = "11" or EventID = 11)
| parse field=_raw "TargetFilename: *\r" as TargetFilename nodrop
| parse field=_raw "Image: *\r" as Image nodrop
| where (TargetFilename matches "*wwwroot*" or TargetFilename matches "*htdocs*" or TargetFilename matches "*/var/www/*")
| where (TargetFilename matches "*index.html" or TargetFilename matches "*index.php" or TargetFilename matches "*default.aspx" or TargetFilename matches "*wp-config.php")
| where !(Image matches "*msbuild.exe" or Image matches "*dotnet.exe" or Image matches "*git.exe" or Image matches "*w3wp.exe")
| eval Indicator = "WebRootHomepageTamperedByUnexpectedProcess"
| stats count as EventCount, values(Image) as WritingProcesses by TargetFilename, Indicator
| sort - EventCount

rule website_defacement_web_root_tamper {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects homepage/landing-page file tampering in a web-exposed directory by a process outside known deployment tooling"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1491.001"
    created = "2026-07-18"

  events:
    $file.metadata.event_type = "FILE_CREATION"
    re.regex($file.target.file.full_path, `(?i)(wwwroot|htdocs|inetpub|/var/www/|/usr/share/nginx/)`)
    re.regex($file.target.file.full_path, `(?i)(index\.html|index\.php|index\.htm|default\.aspx|default\.asp|home\.html|wp-config\.php)$`)
    not re.regex($file.principal.process.file.full_path, `(?i)(msbuild|dotnet|git|w3wp|docker)[.]exe`)

  condition:
    $file
}

#event_simpleName=FileWritten
| FileName = /(?i)(index\.html|index\.php|index\.htm|default\.aspx|default\.asp|home\.html|wp-config\.php)$/
| FilePath = /(?i)(wwwroot|htdocs|inetpub|\/var\/www\/|\/usr\/share\/nginx\/)/
| ContextBaseFileName != /(?i)(msbuild|dotnet|git|w3wp|docker)[.]exe/
| groupBy([ComputerName, FileName, FilePath], function=[count(as=EventCount), collect(ContextBaseFileName, limit=10)])
| sort(EventCount, order=desc)