T1491 Defacement
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential Ransomware Activity Using LegalNotice Messagehightest · windows
- Potentially Suspicious Desktop Background Change Using Reg.EXEmediumtest · windows
- Potentially Suspicious Desktop Background Change Via Registrymediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.