An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Internal Website and System Content Defacement via UI or Messaging Modifications
is blocked by Data Backup
is blocked by Business Continuity Management System (BCMS)
is blocked by Alternate Processing Site
is blocked by Data Backups
is blocked by Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution
is blocked by Secure Baseline Configurations
is blocked by Continuous Monitoring
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Access Enforcement
is blocked by Least Privilege
Impressum Deutsch Englisch