auren-research/cyber-sec huggingface dataset:
modified: 2023-10-20T17:01:38.562Z
name: Authorization Enforcement
description: The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies. Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector (Citation: International Electrotechnical Commission July 2020), while IEEE 1686 defines standard permissions for users of IEDs. (Citation: Institute of Electrical and Electronics Engineers January 2014)
labels: IEC 62443-3-3:2013 - SR 2.1
IEC 62443-4-2:2019 - CR 2.1
NIST SP 800-53 Rev. 5 - AC-3
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.1
type: course-of-action
spec_version: 2.1
id: course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0800
external_id: M0800
source_name: Institute of Electrical and Electronics Engineers January 2014
description: Institute of Electrical and Electronics Engineers 2014, January 1686-2013 - IEEE Standard for Intelligent Electronic Devices Cyber Security Capabilities Retrieved. 2020/09/17 
url: https://standards.ieee.org/standard/1686-2013.html
source_name: International Electrotechnical Commission July 2020
description: International Electrotechnical Commission 2020, July 17 IEC 62351 - Power systems management and associated information exchange - Data and communications security Retrieved. 2020/09/17 
url: https://webstore.iec.ch/publication/6912
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: course-of-action
spec_version: 2.1
id: course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48
created: 2019-06-06T16:50:58.767Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0918
external_id: M0918
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:33.298Z
name: User Account Management
description: Manage the creation, modification, use, and permissions associated to user accounts.
labels: IEC 62443-3-3:2013 - SR 1.3
IEC 62443-4-2:2019 - CR 1.3
NIST SP 800-53 Rev. 5 - AC-2
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd
created: 2019-06-06T21:16:18.709Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0811
external_id: M0811
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:33.475Z
name: Redundancy of Service
description: Redundancy could be provided for both critical ICS devices and services, such as back-up devices or hot-standbys.
labels: NIST SP 800-53 Rev. 5 - CP-9
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971
created: 2019-06-06T20:54:49.964Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0922
external_id: M0922
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:33.651Z
name: Restrict File and Directory Permissions
description: Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
labels: IEC 62443-3-3:2013 - SR 2.1
IEC 62443-4-2:2019 - CR 2.1
NIST SP 800-53 Rev. 5 - AC-6
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--facb8840-ebe7-49f1-b464-8ef6c8131e21
created: 2019-07-19T14:40:23.529Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0954
external_id: M0954
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:33.833Z
name: Software Configuration
description: Implement configuration changes to software (other than the operating system) to mitigate security risks associated with how the software operates.
labels: IEC 62443-3-3:2013 - SR 7.7
IEC 62443-4-2:2019 - CR 7.7
NIST SP 800-53 Rev. 5 - CM-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7
created: 2019-06-11T17:08:33.055Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0949
external_id: M0949
source_name: NCCIC August 2018
description: NCCIC 2018, August 2 Recommended Practice: Updating Antivirus in an Industrial Control System Retrieved. 2020/09/17 
url: https://us-cert.cisa.gov/sites/default/files/recommended_practices/Recommended%20Practice%20Updating%20Antivirus%20in%20an%20Industrial%20Control%20System_S508C.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:34.009Z
name: Antivirus/Antimalware
description: Use signatures or heuristics to detect malicious software. Within industrial control environments, antivirus/antimalware installations should be limited to assets that are not involved in critical or real-time operations. To minimize the impact to system availability, all products should first be validated within a representative test environment before deployment to production systems. (Citation: NCCIC August 2018)
labels: IEC 62443-3-3:2013 - SR 3.2
IEC 62443-4-2:2019 - CR 3.2
NIST SP 800-53 Rev. 4 - SI-3
NIST SP 800-53 Rev. 5 - SI-3
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0806
external_id: M0806
source_name: CISA March 2010
description: CISA 2010, March Securing Wireless Networks Retrieved. 2020/09/17 
url: https://us-cert.cisa.gov/ncas/tips/ST05-003
source_name: DHS National Urban Security Technology Laboratory April 2019
description: DHS National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17 
url: https://www.dhs.gov/sites/default/files/saver-msr-rf-detection_cod-508_10july2019.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:34.172Z
name: Minimize Wireless Signal Propagation
description: Wireless signals frequently propagate outside of organizational boundaries, which provide opportunities for adversaries to monitor or gain unauthorized access to the wireless network. (Citation: CISA March 2010) To minimize this threat, organizations should implement measures to detect, understand, and reduce unnecessary RF propagation. (Citation: DHS National Urban Security Technology Laboratory April 2019)
labels: IEC 62443-3-3:2013 - SR 1.6
IEC 62443-4-2:2019 - CR 1.6
NIST SP 800-53 Rev. 5 - SC-40
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--1d8dccb3-e779-4702-aeb1-6627a22cc585
created: 2017-05-31T21:33:21.973Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-ics-attack
url: https://collaborate.mitre.org/attackics/index.php/Software/S0001
external_id: S1004
source_name: ESET Win32/Industroyer
description: Anton Cherepanov, ESET. (2017, June 12). Win32/Industroyer: A new threat for industrial control systems. Retrieved September 15, 2017.
url: https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf
source_name: Dragos Crashoverride
description: Dragos Inc.. (2017, June 13). Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations. Retrieved September 18, 2017.
url: https://www.dragos.com/wp-content/uploads/CrashOverride-01.pdf
source_name: CISA Alert TA17-163A CrashOverride June 2017
description: CISA. (2017, June 12). Alert (TA17-163A). Retrieved October 22, 2019.
url: https://us-cert.cisa.gov/ncas/alerts/TA17-163A
source_name: Dragos Crashoverride 2018
description: Dragos. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved October 14, 2019.
url: https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf
source_name: Dragos Crashoverride 2019
description: Joe Slowik. (2019, August 15). CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack. Retrieved October 22, 2019.
url: https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:54.754Z
name: Industroyer
description: [Industroyer](https://collaborate.mitre.org/attackics/index.php/Software/S0001) is a sophisticated piece of malware designed to cause an [Impact](https://collaborate.mitre.org/attackics/index.php/Impact) to the working processes of Industrial Control Systems (ICS), specifically ICSs used in electrical substations.(Citation: ESET Win32/Industroyer) Industroyer was alleged to be used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride)(Citation: CISA Alert (TA17-163A))(Citation: Dragos Crashoverride 2018)(Citation: Dragos Crashoverride 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Industroyer
CRASHOVERRIDE
type: malware
spec_version: 2.1
id: malware--242622ca-3903-43d5-8aa0-3bbdaa3020ec
created: 2017-05-31T21:32:59.661Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-ics-attack
url: https://collaborate.mitre.org/attackics/index.php/Software/S0005
external_id: S1001
source_name: ESET Bad Rabbit Oct 2017
description: https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/
url: https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/
source_name: Kaspersky Bad Rabbit Oct 2017
description: Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov. (2017, October 27). Bad Rabbit Ransomware. Retrieved October 27, 2019.
url: https://securelist.com/bad-rabbit-ransomware/82851/
source_name: Dragos IT Ransomware for ICS Environments Apr 2019
description: Joe Slowik. (2019, April 10). Implications of IT Ransomware for ICS Environments. Retrieved October 27, 2019.
url: https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:54.935Z
name: Bad Rabbit
description: [Bad Rabbit](https://collaborate.mitre.org/attackics/index.php/Software/S0005) is a self-propagating (“wormable”) ransomware that affected the transportation sector in Ukraine. (Citation: ESET Bad Rabbit Oct 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Bad Rabbit
Diskcoder.D
type: malware
spec_version: 2.1
id: malware--496bff4d-0700-4b28-b06f-f30a63002be7
created: 2019-03-26T15:02:14.907Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-ics-attack
url: https://collaborate.mitre.org/attackics/index.php/Software/S0010
external_id: S1008
source_name: Wired W32.Stuxnet Dossier Feb 2011
description: Nicolas Falliere, Liam O Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier (Version 1.4). Retrieved September 22, 2017.
url: https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf
source_name: Symantec W32.Stuxnet Writeup
description: Jarrad Shearer. (n.d.). W32.Stuxnet Writeup. Retrieved October 22, 2019.
url: https://www.symantec.com/security-center/writeup/2010-071400-3123-99
source_name: CISA ICS Advisory ICSA-10-238-01B Stuxnet January 2014
description: CISA. (2014, January 08). Stuxnet Malware Mitigation (Update B). Retrieved October 22, 2019.
url: https://www.us-cert.gov/ics/advisories/ICSA-10-238-01B
source_name: SCADAhacker Stuxnet Mitigation Jan 2014
description: Joel Langill. (2014, January 21). Stuxnet Mitigation. Retrieved October 22, 2019.
url: https://scadahacker.com/resources/stuxnet-mitigation.html
source_name: Langer Stuxnet Analysis Nov 2013
description: Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved March 27, 2018.
url: https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:55.125Z
name: Stuxnet
description: [Stuxnet](https://collaborate.mitre.org/attackics/index.php/Software/S0010) was the first publicly reported piece of malware to specifically target industrial control systems devices. Stuxnet is a large and complex piece of malware that utilized multiple different complex tactics including multiple zero-day vulnerabilites, a sophisticated Windows rootkit, and network infection routines.(Citation: Wired W32.Stuxnet Dossier Feb 2011)(Citation: Symantec W32.Stuxnet Writeup)(Citation: CISA ICS Advisory (ICSA-10-238-01B))(Citation: SCADAhacker Stuxnet Mitigation Jan 2014)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Stuxnet
type: malware
spec_version: 2.1
id: malware--49c04994-1035-4b58-89b7-cf8956e3b423
created: 2017-05-31T21:32:59.661Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-ics-attack
url: https://collaborate.mitre.org/attackics/index.php/Software/S0012
external_id: S1003
source_name: Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary
description: Catalin Cimpanu. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved October 14, 2019.
url: https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml
source_name: Symantec Conficker Jun 2015
description: Symantec. (2015, June 30). Simple steps to protect yourself from the Conficker Worm. Retrieved December 5, 2019.
url: https://support.symantec.com/us/en/article.tech93179.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:55.301Z
name: Conficker
description: [Conficker](https://collaborate.mitre.org/attackics/index.php/Software/S0012) is a computer worm that targets Microsoft Windows and was first detected in November 2008. It targets a vulnerability (MS08-067) in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet. Conficker made its way onto computers and removable disk drives in a nuclear power plant. (Citation: Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Conficker
Downadup
Kido
type: malware
spec_version: 2.1
id: malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe
created: 2019-03-26T15:02:14.907Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1006
external_id: S1006
source_name: Spenneberg, Ralf 2016
description: Spenneberg, Ralf 2016 PLC-Blaster Retrieved. 2019/06/06 
url: https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf
source_name: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016
description: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 
url: https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:24.423Z
name: PLC-Blaster
description: [PLC-Blaster](https://attack.mitre.org/software/S1006) is a piece of proof-of-concept malware that runs on Siemens S7 PLCs. This worm locates other Siemens S7 PLCs on the network and attempts to infect them. Once this worm has infected its target and attempted to infect other devices on the network, the worm can then run one of many modules. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016) (Citation: Spenneberg, Ralf 2016) 
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: PLC-Blaster
type: malware
spec_version: 2.1
id: malware--736a3b71-eccc-48b7-b5ed-adb2b74ca830
created: 2017-05-31T21:33:21.973Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-ics-attack
url: https://collaborate.mitre.org/attackics/index.php/Software/S0016
external_id: S1005
source_name: ESET BlackEnergy Jan 2016
description: Anton Cherepanov. (n.d.). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved October 29, 2019.
url: https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/
source_name: Booz Allen Hamilton
description: Booz Allen Hamilton. (n.d.). When The Lights Went Out. Retrieved October 22, 2019.
url: https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:55.503Z
name: Killdisk
description: In 2015 the BlackEnergy malware contained a component called KillDisk. KillDisk's main functionality is to overwrite files with random data, rendering the OS unbootable. (Citation: ESET BlackEnergy Jan 2016)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Killdisk
modified: 2024-04-17T16:12:43.754Z
name: Triton
description: [Triton](https://attack.mitre.org/software/S1009) is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers.(Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017)(Citation: Dragos December 2017)(Citation: DHS CISA February 2019)(Citation: Schneider Electric January 2018)(Citation: Julian Gutmanis March 2019)(Citation: Schneider December 2018)(Citation: Jos Wetzels January 2018)
is_family: yes
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.1
x_mitre_aliases: Triton
TRISIS
HatMan
type: malware
spec_version: 2.1
id: malware--80099a91-4c86-4bea-9ccb-dac55d61960e
created: 2019-03-26T15:02:14.907Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1009
external_id: S1009
source_name: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017
description: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12 
url: https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html
source_name: DHS CISA February 2019
description: DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 
url: https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf
source_name: Dragos December 2017
description: Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 
url: https://dragos.com/blog/trisis/TRISIS-01.pdf
source_name: Jos Wetzels January 2018
description: Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 
url: https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware
source_name: Julian Gutmanis March 2019
description: Julian Gutmanis 2019, March 11 Triton - A Report From The Trenches Retrieved. 2019/03/11 
url: https://www.youtube.com/watch?v=XwSJ8hloGvY
source_name: Schneider December 2018
description: Schneider 2018, December 14 Security Notification EcoStruxure Triconex Tricon V3 Retrieved. 2019/03/08 
url: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2017-347-01+Triconex+V3.pdf&p_Doc_Ref=SEVD-2017-347-01
source_name: Schneider Electric January 2018
description: Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 
url: https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5