MITRE ATT&CKcampaign
C0032 C0032
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-03-28
Description
C0032 was an extended campaign suspected to involve the Triton adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the Triton Safety Instrumented System Attack.
Related
Attributed to · MITRE ATT&CK (1)
- G0088 TEMP.Veles group
Uses · MITRE ATT&CK (18)
- T1583.003 Virtual Private Server sub-technique
- T1588.002 Tool sub-technique
- T1572 Protocol Tunneling technique
- T1571 Non-Standard Port technique
- T1074.001 Local Data Staging sub-technique
- T1059.001 PowerShell sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.004 SSH sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1546.012 Image File Execution Options Injection sub-technique
- T1505.003 Web Shell sub-technique
- T1053.005 Scheduled Task sub-technique
- S0002 Mimikatz software (tool)
- T1078 Valid Accounts technique
- T1133 External Remote Services technique