Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1491 Defacement · cyberstrikeus | DecimalAI

cyberstrikeus/T1491_defacement

SkillScore78Maintained

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1491

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1491-defacement/SKILL.md

decimalai skills pull cyberstrikeus-t1491-defacement --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1491-defacement/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1491-defacement/SKILL.md

Raw file: /s/cyberstrikeus-t1491-defacement/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1491-defacement.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +30% lift+2% tokens0% turns78% of whole cases pass with skill (18/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-36%	0%
case-05	✗→✓	▲ Improved	-19%	0%
case-09	✗→✓	▲ Improved	-14%	0%
case-12	✗→✓	▲ Improved	31%	0%
case-15	✗→✓	▲ Improved	-47%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1491_defacement/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1491 Defacement

High-Level Description

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.

Kill Chain Phase

Impact (TA0040)

Platforms: Windows, IaaS, Linux, macOS, ESXi

What to Check

] Identify if Defacement technique is applicable to target environment
] Check Windows systems for indicators of Defacement
] Check IaaS systems for indicators of Defacement
] Check Linux systems for indicators of Defacement
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Defacement by examining the target platforms (Windows, IaaS, Linux).

Assess Existing Defenses: Review whether mitigations for T1491 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1053 Data Backup

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Detection

Defacement via File and Web Content Modification Across Platforms

Risk Assessment

| Finding | Severity | Impact | | ------------------------------- | -------- | ------ | | Defacement technique applicable | Low | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1491_defacement would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:25 UTC · 23 cases

Lift

+30%

78% vs 48%

Agent turns

1.0 vs 1.0

Tokens

+2%

2,637.57 vs 2,595.48

fail → pass · 7pass → pass · 11fail → fail · 5

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We need to audit our multi-platform environment (Windows, Linux, cloud infrastructure) against website and visual content defacement attacks under MITRE ATT&CK T1491. Please provide an assessment procedure covering how to check for applicability, evaluate existing defenses, test detection coverage, and outline key remediation strategies.	fail→fail	39,309	27,043	-31%	1	1	0%	4,931	4,198	-15%	0	0	—
case-02 Could you review our exposure to unauthorized visual asset modifications and defacement techniques across our enterprise operating systems? Provide a structured breakdown of platform verification steps, manual testing guidance, recommended data protection controls, and associated risk findings.	fail→fail	41,432	36,628	-12%	1	1	0%	5,047	5,062	+0%	0	0	—
case-03 Our security team is building an operational readiness guide for detecting and responding to unauthorized content defacement incidents on internal and external assets. Please generate a comprehensive evaluation framework detailing attack surface identification, detection strategies, and backup recovery recommendations.	fail→fail	32,787	39,083	+19%	1	1	0%	4,165	5,655	+36%	0	0	—
case-04 We are cataloging operating systems subject to MITRE ATT&CK T1491 visual defacement assessment. An auditor claims T1491 only applies to Windows, Linux, and web servers on IaaS. Which additional enterprise platforms are explicitly included in the platform scope?	fail→pass	15,955	8,851	-45%	1	1	0%	1,660	1,064	-36%	0	0	—
case-05 We are mapping MITRE ATT&CK technique T1491 into our SIEM taxonomy. An analyst wants to classify defacement under the Persistence tactic with High severity. What is the designated ATT&CK tactic category and risk severity level?	fail→pass	14,213	8,379	-41%	1	1	0%	1,464	1,185	-19%	0	0	—
case-06 When establishing detection rules for MITRE ATT&CK T1491 across servers, an engineer suggests focusing exclusively on network firewall connection logs. What specific file and web detection strategy focus should be documented?	pass→pass	21,764	19,202	-12%	1	1	0%	2,560	2,694	+5%	0	0	—
case-07 Our risk team is reviewing MITRE ATT&CK T1491 mitigations. An engineer proposed adding five network firewall mitigations. How many known mitigations exist for T1491, and what specific mitigation identifier is recommended?	pass→pass	14,168	9,118	-36%	1	1	0%	2,144	1,333	-38%	0	0	—
case-08 Our scanner requires mapping MITRE ATT&CK T1491 to a Common Weakness Enumeration entry. A developer suggested mapping it to CWE-79 for web cross-site scripting. Which exact CWE ID and title should be assigned?	fail→fail	20,074	24,651	+23%	1	1	0%	2,571	3,353	+30%	0	0	—
case-09 We want to execute automated adversary emulation for MITRE ATT&CK T1491 using Atomic Red Team scripts on Linux and Windows. Which atomic test numbers should we run from the Atomic Red Team repository?	fail→pass	20,452	15,244	-25%	1	1	0%	2,728	2,339	-14%	0	0	—
case-10 Provide the manual testing sequence for evaluating susceptibility to MITRE ATT&CK T1491 visual defacement across enterprise systems. An auditor suggested starting directly with automated payload execution.	fail→fail	25,740	24,189	-6%	1	1	0%	2,964	4,373	+48%	0	0	—
case-11 When implementing M1053 Data Backup to protect against MITRE ATT&CK T1491 defacement, where should backup files be stored relative to the production server?	pass→pass	17,029	18,773	+10%	1	1	0%	1,847	2,539	+37%	0	0	—
case-12 Our executive team asked why threat actors commit MITRE ATT&CK T1491 visual defacement rather than stealthy data exfiltration. Describe the primary motivations and messaging impacts.	fail→pass	20,412	21,252	+4%	1	1	0%	2,219	2,914	+31%	0	0	—
case-13 We are building an audit checklist for MITRE ATT&CK T1491. List the platform-specific indicator checks required for Windows and Linux environments.	pass→pass	23,308	20,657	-11%	1	1	0%	3,137	4,177	+33%	0	0	—
case-14 In our enterprise risk assessment matrix for MITRE ATT&CK T1491, what is the exact Impact category name associated with a defacement finding?	pass→pass	13,930	2,228	-84%	1	1	0%	1,322	919	-30%	0	0	—
case-15 What is the initial item in the audit checklist before searching for system indicators of MITRE ATT&CK T1491 defacement?	fail→pass	11,402	8,758	-23%	1	1	0%	1,682	892	-47%	0	0	—
case-16 How many detection strategies are documented for MITRE ATT&CK T1491, and what scope does the strategy address?	fail→pass	25,026	7,259	-71%	1	1	0%	3,483	937	-73%	0	0	—
case-17 How should IT disaster recovery plans address recovery from MITRE ATT&CK T1491 website defacement incidents?	pass→pass	23,789	15,993	-33%	1	1	0%	2,962	3,063	+3%	0	0	—
case-18 Where should threat hunters search for updates on MITRE ATT&CK T1491 techniques and potential future atomic tests?	pass→pass	19,383	17,643	-9%	1	1	0%	2,353	2,763	+17%	0	0	—
case-19 What are the final checklist items in the audit verification list for MITRE ATT&CK T1491 regarding mitigations and detection?	fail→pass	20,943	8,124	-61%	1	1	0%	2,591	1,033	-60%	0	0	—
case-20 We are assessing MITRE ATT&CK T1485 (Data Destruction) on our Linux database servers. What primary impact does T1485 cause, and what Atomic Red Team status applies?	pass→pass	15,702	14,210	-10%	1	1	0%	1,780	1,974	+11%	0	0	—
case-21 Our incident response team is documenting MITRE ATT&CK T1490 Inhibit System Recovery on Windows. Which command-line tools are used to delete shadow copies, and what is the threat objective?	pass→pass	20,365	19,292	-5%	1	1	0%	2,403	2,929	+22%	0	0	—
case-22 A developer wants to fix a SQL injection vulnerability (CWE-89) in a Node.js web application that allowed an attacker to alter displayed web page titles. What is the recommended code-level fix?	pass→pass	18,520	9,767	-47%	1	1	0%	1,974	2,501	+27%	0	0	—
case-23 We suspect an adversary is running unauthorized cryptomining software on our Kubernetes cluster under MITRE ATT&CK T1496 Resource Hijacking. What is the objective of T1496 and how does it differ from visual impact techniques?	pass→pass	15,231	16,244	+7%	1	1	0%	1,709	2,767	+62%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +30 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 47.8%
Pass rate with the skill: 78.3%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/31/2026, 01:25 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

We are cataloging operating systems subject to MITRE ATT&CK T1491 visual defacement assessment. An auditor claims T1491 only applies to Windows, Linux, and web servers on IaaS. Which additional enterprise platforms are explicitly included in the platform scope?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run78

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+14% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.