What is the authoritative source for T1491.002?

External Defacement (T1491.002) is catalogued in MITRE ATT&CK Enterprise and curated for EU compliance use cases by SQUR.

Which ATT&CK tactics does T1491.002 belong to?

T1491.002 (External Defacement) maps to the following MITRE ATT&CK tactic(s): impact.

T1491.002SubTechniqueimpactagent-callable

T1491.002External Defacement

Sub-technique of T1491

Platforms: Windows · IaaS · Linux · macOS

ATT&CK version: 14.1

What it is

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)

ATT&CK tactics· 1

Impact

References

Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.