CmdID

CmdID / Techniques / T1491

T1491.001 Defacement: Internal Defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. MITRE ATT&CK

1 program on CmdID 1 Sigma rule T1491.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1491Defacement

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
reg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
mediumPotentially Suspicious Desktop Background Change Using Reg.EXEStephen Lincoln @slincoln-aiq (AttackIQ) · Windows