Defacement T1491
Tactic: Impact
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.
Events covered
4 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
These 12 rules share fields, values, and exclusions.
Fields filtered most (20 distinct)
These fields appear most often in rule filters.
Top indicator values (60 distinct)
These values appear most often in rule predicates.
Exclusions (9 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 4 rules
- Potential Ransomware Activity Using LegalNotice Message
- Potentially Suspicious Desktop Background Change Using Reg.EXE
- Potentially Suspicious Desktop Background Change Via Registry
- Replace Desktop Wallpaper by Powershell