Techniques › T1491.001 › AN0231
AN0231 Analytic 0231
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Modification of user desktop backgrounds, login screen messages, or system banners by adversaries using admin privileges or script execution. May coincide with tampering in /Library/Desktop Pictures/ or use of AppleScript.</p>
- Detects
- T1491.001 Internal Defacement
- Part of
- DET0082 Internal Website and System Content Defacement via UI or Messaging Modifications
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | loginwindow or desktopservices modified settings or files | DC0061 File Modification |
| macos:unifiedlog | osascript or AppleScript invocation modifying UI | DC0029 Script Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ScriptNames | Uncommon scripts like AppleScript variants or osascript for wallpaper changes |
UserContext | Normal users should not alter global visual settings |