MITRE ATT&CK technique
Defacement detection rulesT1491
Defacement (T1491) is a MITRE ATT&CK technique in the Impact tactic. This page lists the 4 community-maintained Sigma detection rules in the library mapped to T1491 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Potential Ransomware Activity Using LegalNotice Message
highDetect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
windows · registry_set
Potentially Suspicious Desktop Background Change Using Reg.EXE
mediumDetects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
windows · process_creation
Potentially Suspicious Desktop Background Change Via Registry
mediumDetects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
windows · registry_set
Replace Desktop Wallpaper by Powershell
lowAn adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
windows · ps_script