In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.4
campaign
Triton Safety Instrumented System Attack C0030
- First seen
- June 2017
- Last seen
- August 2017
- Created
- 25 March 2024
- Last modified
- 31 July 2026
Triton Safety Instrumented System Attack was a campaign employed by TEMP.Veles which leveraged the Triton malware framework against a petrochemical organization.[1] The malware and techniques used within this campaign targeted specific Triconex Safety Controllers within the environment.[2] The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.[3]
10
Techniques32nd pct
9
Tactics54th pct
1
Tool or malware45th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0030
In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.5
In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.6
In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.7
In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.8
Standing C0030
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1032nd pct
32nd percentile · 68% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics954th pct
54th percentile · 54% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique12.5med41st pct
41st percentile · 59% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique0.5med
Detection coverage C0030
523 distinct rules cover the 10 techniques recorded for this campaign. The 544 technique-to-rule mappings resolve to 523 distinct rules, because one rule can cover several techniques. 402 Sigma · 121 Splunk.
9 covered by at least one rule1 with no coverage523 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org