T1491.001, Internal Defacement, is defacement of systems inside the organization. It applies to ESXi, Linux, macOS and Windows and falls under impact.
How attackers use it
An adversary may deface internal systems to intimidate or mislead users and discredit the integrity of those systems. That can mean changes to internal websites or server login messages, or replacing the desktop wallpaper on user systems.
MITRE notes that because internal defacement exposes the adversary's presence, it often comes after other goals are met. That makes it a late stage sign. MITRE's examples include ransomware that sets the desktop wallpaper to show a ransom note or leaves notes in every directory it encrypts, and a group that leaves taunting images on victim desktops as proof of access.
How to detect it
MITRE's detection strategy covers general, Linux, macOS and ESXi cases.
- General: scripted or unauthorized changes to internal user interface messages or hosted intranet pages, often after privilege escalation or web shell deployment.
- Linux: root or sudo changes to system banners, web content directories such as /var/www/html, or login files such as /etc/issue, alongside suspicious script or cron activity.
- macOS: admin level or scripted changes to desktop backgrounds, login messages or system banners, especially in /Library/Desktop Pictures/ or with AppleScript use.
- ESXi: changes to the host login banner or message of the day at /etc/motd, through SSH, the console or API calls from a compromised vSphere client.
Watching those few files costs little. A change to a login banner that nobody requested is a strong signal.
How to reduce the risk
MITRE lists data backup. Keep backups stored off system and protected, and keep known good copies of banners and internal content so you can restore them.
Quick check
Why is internal defacement often a late stage sign?
It exposes the adversary's presence, so it usually happens after other intrusion goals are complete.
