自动化接入 · API / MCP EN

技术说明 · T1491.001

Internal Defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper. Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.

ATT&CK T1491.001 platforms — 状态 有效 版本 20.1

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.12 Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.3

  1. Novetta Blockbuster
  2. Varonis
  3. Novetta Blockbuster Destructive Malware

使用该技术的组织

组织名称国家
grp_g1043BlackByte—
grp_g0032Lazarus GroupDPRK
grp_g1057ShinyHunters—
grp_g0047Gamaredon GroupRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核;置信度与有效期按引用读取。