During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.2
campaign
C0032 C0032
- First seen
- October 2014
- Last seen
- January 2017
- Created
- 28 March 2024
- Last modified
- 31 July 2026
C0032 was an extended campaign suspected to involve the Triton adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the Triton Safety Instrumented System Attack.[1]
17
Techniques50th pct
10
Tactics68th pct
1
Tool or malware45th pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0032
During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.3
During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.4
During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.5
During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.6
During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.7
Standing C0032
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1750th pct
50th percentile · 50% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics1068th pct
68th percentile · 68% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tool or malware145th pct
45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique30medTop 11%
89th percentile · 89% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique3med
Detection coverage C0032
806 distinct rules cover the 17 techniques recorded for this campaign. The 855 technique-to-rule mappings resolve to 806 distinct rules, because one rule can cover several techniques. 557 Sigma · 249 Splunk.
16 covered by at least one rule1 with no coverage806 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org