MITRE ATT&CKsoftware (malware)

S1009 Triton

Published 2019-03-26 Modified 2026-05-12 Official page ↗
Domain
ics
Aliases
TRISIS, HatMan
Version
1.2
Created
2019-03-26

Description

Triton is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers.

Related

Uses · MITRE ATT&CK (18)

  • T1701.005 Python sub-technique
  • T0846.002 Broadcast Discovery sub-technique
  • T1693.001 System Firmware sub-technique
  • T0821 Modify Controller Tasking technique
  • T0834 Native API technique
  • T0890 Exploitation for Privilege Escalation technique
  • T0820 Exploitation for Evasion technique
  • T0843 Program Download technique
  • T0845 Program Upload technique
  • T0849 Masquerading technique
  • T0858 Change Operating Mode technique
  • T0868 Detect Operating Mode technique
  • T0869 Standard Application Layer Protocol technique
  • T0871 Execution through API technique
  • T0872 Indicator Removal on Host technique
  • T0874 Hooking technique
  • T0880 Loss of Safety technique
  • T0885 Commonly Used Port technique

Referenced by MITRE ATT&CK · uses (2)

  • C0030 Triton Safety Instrumented System Attack campaign
  • G0088 TEMP.Veles group

References