ATT&CK T1491 - Web Defacement: Suspicious PUT to web server

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP PUT requests to a web server where the URI path ends with common web file extensions such as .html, .htm, .php, .asp, or .aspx. This behavior is suspicious as it could indicate an attempt at web defacement (T1491) by an attacker trying to modify web content directly on the server.