Techniques › T1491 › T1491.001
T1491.001 Internal Defacement
impact — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
4
Sigma rules tagged attack.t1491.001
0
KEV CVEs mapped here
<p>An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper. Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0082 Internal Website and System Content Defacement via UI or Messaging Modifications v1.0
AN0229 WindowsAdversary modifies internal UI messages (e.g., login banners, desktop wallpapers) or hosted intranet web pages by creating or altering content files using scripts or unauthorized access. Often preceded by privilege escalation or web shell deployment.Tunable:
FilePathPatternTimeWindowUserContextAN0230 LinuxAdversary leverages root or sudo access to alter system banners, web content directories (e.g., /var/www/html), or login configurations (/etc/issue). File creation or overwrites may coincide with suspicious script execution or cron job activity.Tunable:TargetDirectoriesUserContextTimeWindowAN0231 macOSModification of user desktop backgrounds, login screen messages, or system banners by adversaries using admin privileges or script execution. May coincide with tampering in /Library/Desktop Pictures/ or use of AppleScript.macos:unifiedlogloginwindow or desktopservices modified settings or files→ DC0061 File ModificationTunable:ScriptNamesUserContextAN0232 ESXiAdversary modifies ESXi host login banner or MOTD file (/etc/motd), either through SSH or host console access. May involve configuration file overwrite or API calls from compromised vSphere clients.Tunable:LoginBannerFilePathAccessOrigin
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1491.001
Author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)
· 2023-12-21 (modified 2025-10-17) · logsource: product=windows category=registry_set · 85b88e05-dadc-430b-8a9e-53ff1cd30aae
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Author: frack113
· 2022-12-11 (modified 2023-08-17) · logsource: product=windows category=registry_set · 8b9606c9-28be-4a38-b146-0e313cc232c1
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
Author: Stephen Lincoln @slincoln-aiq (AttackIQ)
· 2023-12-21 · logsource: product=windows category=process_creation · 8cbc9475-8d05-4e27-9c32-df960716c701
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Author: frack113
· 2021-12-26 · logsource: product=windows category=ps_script · c5ac6a1e-9407-45f5-a0ce-ca9a0806a287
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper