tfMITRE ATT&CK sub-technique

Internal Defacement T1491.001

Tactic: Impact
Platforms: ESXi, Linux, macOS, Windows
Version: 1.2
Created: 20 February 2020
Last modified: 12 May 2026

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.[1][2] Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.[3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Internal Defacement MITRE reference T1491.001

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.1

created 2026-07-291 referenceaka UNC6240

BlackByteG1043 ↗

Left ransom notes in all directories where encryption takes place.1

created 2024-12-161 referenceaka Hecamede

Gamaredon GroupG0047 ↗

Has left taunting images and messages on the victims' desktops as proof of system access.1

created 2017-05-311 referenceaka IRON TILDEN

Lazarus GroupG0032 ↗

Replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 4 groups for this technique

Offense vs defense T1491.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2021 Q4

Internal Defacement detection strategy DET0082

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Internal Website and System Content Defacement via UI or Messaging Modifications

Enterprise

4 platforms

AN0229 · Windows

Adversary modifies internal UI messages (e.g., login banners, desktop wallpapers) or hosted intranet web pages by creating or altering content files using scripts or unauthorized access. Often preceded by privilege escalation or web shell deployment.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilePathPattern	Location of web content or system UI config files that may vary across deployments (e.g., %SystemRoot%\Web, %APPDATA%\wallpaper.jpg)
TimeWindow	Allowed hours for file/content modification events; defacement likely occurs during off-hours
UserContext	System or domain accounts used to perform the modifications may be anomalous

AN0230 · Linux

Adversary leverages root or sudo access to alter system banners, web content directories (e.g., /var/www/html), or login configurations (/etc/issue). File creation or overwrites may coincide with suspicious script execution or cron job activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	linux:syslog	sudo or su access prior to content change
Process CreationDC0032	auditd:SYSCALL	execve
File ModificationDC0061	auditd:SYSCALL	open/write/unlink

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDirectories	Paths like /var/www/html, /etc/issue, or /etc/motd may vary across distros
UserContext	Non-web-admin users modifying site content or banners should be rare
TimeWindow	Defacement often happens outside normal maintenance hours

AN0231 · macOS

Modification of user desktop backgrounds, login screen messages, or system banners by adversaries using admin privileges or script execution. May coincide with tampering in /Library/Desktop Pictures/ or use of AppleScript.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	osascript or AppleScript invocation modifying UI
File ModificationDC0061	macos:unifiedlog	loginwindow or desktopservices modified settings or files

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptNames	Uncommon scripts like AppleScript variants or osascript for wallpaper changes
UserContext	Normal users should not alter global visual settings

AN0232 · ESXi

Adversary modifies ESXi host login banner or MOTD file (/etc/motd), either through SSH or host console access. May involve configuration file overwrite or API calls from compromised vSphere clients.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	ESXiLogs:messages	changes to /etc/motd or /etc/vmware/welcome
Command ExecutionDC0064	esxi:hostd	modification of config files or shell command execution

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LoginBannerFilePath	Target file paths (e.g., /etc/motd) may be changed via symbolic link or override
AccessOrigin	ESXi hostd vs. SSH-based defacement origin may affect visibility

Tests4ExecutorsPowerShell 3 · cmd 1Need elevation1 of 4Have prerequisites2Have cleanup3Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Replace Desktop Wallpaper

windows

PowerShell

—

Yes

Downloads an image from a URL and sets it as the desktop wallpaper.

Input arguments

Name	Type	Default	Description
url_of_wallpaper	url	https://redcanary.com/wp-content/uploads/Atomic-Red-Team-Logo.png	URL pointing to the image file you wish to set as wallpaper
wallpaper_location	string	$env:TEMP\T1491.001-newWallpaper.png	Full path to where the downloaded wallpaper image will be saved
pointer_to_orginal_wallpaper	string	$env:TEMP\T1491.001-OrginalWallpaperLocation	Full path to where a file containing the original wallpaper location will be saved

Attack command

$url = "#{url_of_wallpaper}"
$imgLocation = "#{wallpaper_location}"
$orgWallpaper = (Get-ItemProperty -Path Registry::'HKEY_CURRENT_USER\Control Panel\Desktop\' -Name WallPaper).WallPaper
$orgWallpaper | Out-File -FilePath "#{pointer_to_orginal_wallpaper}"
$updateWallpapercode = @' 
using System.Runtime.InteropServices; 
namespace Win32{

    public class Wallpaper{ 
        [DllImport("user32.dll", CharSet=CharSet.Auto)] 
         static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ; 
         
         public static void SetWallpaper(string thePath){ 
            SystemParametersInfo(20,0,thePath,3); 
        }
    }
} 
'@
$wc = New-Object System.Net.WebClient  
try{  
    $wc.DownloadFile($url, $imgLocation)
    add-type $updateWallpapercode 
    [Win32.Wallpaper]::SetWallpaper($imgLocation)
} 
catch [System.Net.WebException]{  
    Write-Host("Cannot download $url") 
    add-type $updateWallpapercode 
    [Win32.Wallpaper]::SetWallpaper($imgLocation)
} 
finally{    
    $wc.Dispose()  
}

Cleanup command

$updateWallpapercode = @' 
using System.Runtime.InteropServices; 
namespace Win32{

    public class Wallpaper{ 
        [DllImport("user32.dll", CharSet=CharSet.Auto)] 
         static extern int SystemParametersInfo (int uAction , int uParam , string lpvParam , int fuWinIni) ; 
         
         public static void SetWallpaper(string thePath){ 
            SystemParametersInfo(20,0,thePath,3); 
        }
    }
} 
'@
if (Test-Path -Path #{pointer_to_orginal_wallpaper} -PathType Leaf) {
     $orgImg = Get-Content -Path "#{pointer_to_orginal_wallpaper}"
     add-type $updateWallpapercode 
     [Win32.Wallpaper]::SetWallpaper($orgImg)
}
Remove-Item "#{pointer_to_orginal_wallpaper}" -ErrorAction Ignore
Remove-Item "#{wallpaper_location}" -ErrorAction Ignore

GUID738090fe-208f-4da5-887b-c334391d58e9

Configure LegalNoticeCaption and LegalNoticeText registry keys to display ransom message

windows

PowerShell

Required

—

Yes

Display ransom message to users at system start-up by configuring registry keys HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption and HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Policies\System\LegalNoticeText. SynAck Ransomware, Grief Ransomware, Maze Ransomware, Pysa Ransomware, Spook Ransomware, DopplePaymer Ransomware, Reedemer Ransomware, Kangaroo Ransomware

Input arguments

Name	Type	Default	Description
legal_notice_text	string	Hi Company, every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data contact us:xxxx@onionmail.org	Body of ransom message
legal_notice_caption	string	PYSA	Title of ransom message

Attack command

$orgLegalNoticeCaption = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption).LegalNoticeCaption
$orgLegalNoticeText = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText).LegalNoticeText
$newLegalNoticeCaption = "#{legal_notice_caption}"
$newLegalNoticeText = "#{legal_notice_text}"
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption -Value $newLegalNoticeCaption -Type String -Force
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText -Value $newLegalNoticeText -Type String -Force

Cleanup command

Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeCaption -Value $orgLegalNoticeCaption -Type String -Force
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LegalNoticeText -Value $orgLegalNoticeText -Type String -Force

GUID6b3a3992-7d27-4978-ae1d-776e16d8531f

ESXi - Change Welcome Message on Direct Console User Interface (DCUI)

windows

cmd

—

Changes the ESXi welcome message to potentially display ransom information. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name or IP of the ESXi server.
vm_pass	string	password	Specify the privileged user's password.
vm_user	string	root	Specify the privilege user account on the ESXi server.
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to Plink

Attack command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system welcomemsg set -m 'RANSOMWARE-NOTIFICATION'"

Prerequisite

Check if we have plink

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID908951b2-ac62-426d-974d-3bae9c9fc10f

Windows - Display a simulated ransom note via Notepad (non-destructive)

windows

PowerShell

—

Yes

Creates a temporary ransom-note text file and opens it in Notepad to simulate ransomware "note display" behavior without making destructive changes. SAFE and non-destructive.

Input arguments

Name	Type	Default	Description
note_body	string	Your files are SAFE. This is a TEST note for detection validation by bak3n3k0. No data has been encrypted. This simulation exercises detections for: - notepad.exe launched with a ransom-themed text file - creation of a ransom-themed text file in %TEMP% NON-DESTRUCTIVE Atomic Red Team test.	The body of the ransom note (plain text)
note_title	string	!!! READ_ME_NOW !!!	Title at the top of the ransom note
pid_filename	string	ART-T1491-notepad.pid	File name for storing Notepad PID
note_filename	string	ART-T1491-ransom-note.txt	File name for the simulated ransom note

Attack command

$notePath = Join-Path $env:TEMP "#{note_filename}"
$pidPath  = Join-Path $env:TEMP "#{pid_filename}"

$Title = "#{note_title}"
$Body  = "#{note_body}"

$header  = $Title + "`r`n" + ('=' * $Title.Length) + "`r`n`r`n"
$content = $header + $Body

[System.IO.File]::WriteAllText($notePath, $content, [System.Text.Encoding]::UTF8)

$p = Start-Process notepad.exe -ArgumentList "`"$notePath`"" -PassThru
$p.Id | Out-File -FilePath $pidPath -Encoding ascii -Force

Cleanup command

try {
  # 1. Kill all Notepad processes
  Get-Process notepad -ErrorAction SilentlyContinue |
    ForEach-Object {
      Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
    }

  # 2. Wait briefly for Windows to release file handles
  Start-Sleep -Seconds 1

  # 3. Force delete ransom note + PID file
  $notePath = Join-Path $env:TEMP "ART-T1491-ransom-note.txt"
  $pidPath  = Join-Path $env:TEMP "ART-T1491-notepad.pid"

  if (Test-Path $notePath) {
    Remove-Item $notePath -Force -ErrorAction Stop
  }
  if (Test-Path $pidPath) {
    Remove-Item $pidPath -Force -ErrorAction Stop
  }
}
catch {
  Write-Warning "Cleanup failed with error: $_"
}

Prerequisite

Notepad must be present on the system

Check

where notepad

GUID6df00f40-4670-41ba-abe6-8bb3f0043a13

Tests from Atomic Red Team (MIT licence) · technique definition

Internal Defacement detections T1491.001

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs