T1491.001 Internal Defacement

Technique

T1491.001

Tactics

Impact

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

0

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1491/001

MITRE description

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-09-21 Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Detection coverage

SigmaHQ community rules

• Replace Desktop Wallpaper by Powershell (core)
• Potentially Suspicious Desktop Background Change Using Reg.EXE (core)
• Potentially Suspicious Desktop Background Change Via Registry (core)
• Potential Ransomware Activity Using LegalNotice Message (core)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.