MITRE ATT&CKsub-technique

T1491.001 Internal Defacement

Published 2020-02-20 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
ESXi, Linux, macOS, Windows
Version
1.2
Created
2020-02-20

Description

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper. Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1491 Defacement technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1053 Data Backup mitigation

Referenced by MITRE ATT&CK · uses (16)

  • S9051 The Gentlemen Ransomware software (malware)
  • G1057 ShinyHunters group
  • S9030 SameCoin software (malware)
  • S1242 Qilin software (malware)
  • S1212 RansomHub software (malware)
  • G1043 BlackByte group
  • S1178 ShrinkLocker software (malware)
  • S1150 ROADSWEEP software (malware)
  • S1139 INC Ransomware software (malware)
  • S1070 Black Basta software (malware)
  • S1068 BlackCat software (malware)
  • S0688 Meteor software (malware)
  • S0659 Diavol software (malware)
  • S0332 Remcos software (tool)
  • G0032 Lazarus Group group
  • G0047 Gamaredon Group group

Referenced by Compliance · mitigates (13)

  • CIS-11.2 Perform Automated Backups CIS Safeguard v8.1
  • CIS-11.3 Protect Recovery Data CIS Safeguard v8.1
  • CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References