T1491.001 — Internal Defacement

Tactic: Impact · Platforms: ESXi, Linux, macOS, Windows

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the…

Sub-technique of Defacement (T1491).

Sigma detection rules (4)

title: "T1491.001 Defacement: Internal Defacement"
id: f215940d-b859-43cc-998f-a44f94cab73e
description: 'Detects file-creation events writing to known web-root directories with markup/script extensions, or replacing desktop wallpaper image files, indicative of internal website or system defacement. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: FilePathPattern, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1491/001
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.impact
  - attack.t1491.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_eventid:
    EventID: '11'

  selection_webroot:
    TargetFilename|contains:
      - '\wwwroot\'
      - '\inetpub\'
      - '\htdocs\'
    TargetFilename|endswith:
      - '.html'
      - '.htm'
      - '.php'
      - '.asp'
      - '.aspx'
      - '.jsp'

  selection_wallpaper:
    TargetFilename|contains:
      - '\Themes\TranscodedWallpaper'
      - '\Windows\Web\Wallpaper\'
      - '\AppData\Roaming\Microsoft\Windows\Themes\'
    TargetFilename|endswith:
      - '.jpg'
      - '.jpeg'
      - '.bmp'
      - '.png'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_eventid and (selection_webroot or selection_wallpaper) and not filter_system_account

falsepositives:
  - Legitimate web-content deployments or user-initiated wallpaper changes.

level: medium

title: "T1491.001 Defacement: Internal Defacement"
id: 6683fdf9-7b38-4014-9e72-4e70eaf94401
description: 'Internal Website and System Content Defacement via UI or Messaging Modifications. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) type: PATH with nametype: NORMAL only confirms a path was referenced (e.g. by a mere `cat /etc/motd`), not written, so the prior selection fired on mere reads. Now requires either a PATH nametype of CREATE/DELETE, or a paired SYSCALL record for a write-implying syscall (rename/unlink/truncate family) with success, and excludes known configuration-management tooling from the match. Tune using: TargetDirectories, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1491/001
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.impact
  - attack.t1491.001

logsource:
  category: file_change
  product: linux

detection:
  selection_path:
    type: PATH
    name|contains:
      - '/etc/motd'
      - '/etc/issue'
      - 'wall.conf'
  selection_writetype:
    - type: PATH
      nametype:
        - CREATE
        - DELETE
    - type: SYSCALL
      syscall:
        - rename
        - renameat
        - renameat2
        - unlink
        - unlinkat
        - truncate
        - ftruncate
      success: 'yes'
  filter_config_mgmt:
    type: SYSCALL
    comm:
      - 'ansible-playbook'
      - 'puppet'
      - 'chef-client'
      - 'salt-minion'
      - 'cloud-init'

  condition: selection_path and selection_writetype and not filter_config_mgmt

falsepositives:
  - Legitimate MOTD/banner customization by IT for compliance or informational purposes; scope UserContext/auid to exclude recognized admin sessions and known config-management service accounts for higher fidelity.

level: medium

title: "T1491.001 Defacement: Internal Defacement"
id: 66019b17-d0d4-46fa-b1a6-8208c385dffb
description: 'Internal Website and System Content Defacement via UI or Messaging Modifications. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptNames, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1491/001
author: Shahrukh Khan
date: 2026-03-17
license: MIT
tags:
  - attack.impact
  - attack.t1491.001

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/Desktop Pictures/'
      - '/Library/Preferences/com.apple.loginwindow.plist'
  condition: selection

falsepositives:
  - MDM enrollment profiles and IT branding scripts legitimately modify the login window plist and desktop picture assets, so this requires knowledge of the change being unauthorized rather than a scheduled configuration push.

level: medium

title: "T1491.001 Defacement: Internal Defacement"
id: 874272f4-21b0-41ba-85ea-8d13dab28955
description: 'Internal Website and System Content Defacement via UI or Messaging Modifications. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LoginBannerFilePath, AccessOrigin.'
references:
  - https://attack.mitre.org/techniques/T1491/001
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.impact
  - attack.t1491.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system welcomemsg set'
      - '/etc/vmware/issue'
      - '/etc/issue'

  condition: selection

falsepositives:
  - Legitimate customization of the DCUI or SSH login banner text by administrators; AccessOrigin should be checked against LoginBannerFilePath change history to rule out approved branding updates.

level: medium

Related sub-techniques

• T1491.002 External Defacement

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1491.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan