S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
Security context for executives and security teams
S0692: SILENTTRINITY describes [SILENTTRINITY](https://attack.mitre.org/software/S0692) is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. [SILENTTRINITY](https://attack.mitre.org/software/S0692) was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.(Citation: GitHub SILENTTRINITY March 2022)(Citation: Security Affairs SILENTTRINITY July 2019)
Executive priority
S0692: SILENTTRINITY is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0692: SILENTTRINITY by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0692: SILENTTRINITY appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1552.006 | Group Policy PreferencesSub-technique | SILENTTRINITY has a module that can extract cached GPP passwords.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1620 | Reflective Code Loading | SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.CitationGithub_SILENTTRINITY |
| Enterprise | T1069.002 | Domain GroupsSub-technique | SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1105 | Ingress Tool Transfer | SILENTTRINITY can load additional files and tools, including Mimikatz.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1546.001 | Change Default File AssociationSub-technique | SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1115 | Clipboard Data | SILENTTRINITY can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText()` to collect data from the clipboard.CitationGithub_SILENTTRINITY |
| Enterprise | T1070 | Indicator Removal | SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1003.001 | LSASS MemorySub-technique | SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1135 | Network Share Discovery | SILENTTRINITY can enumerate shares on a compromised host.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1564.003 | Hidden WindowSub-technique | SILENTTRINITY has the ability to set its window state to hidden.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1543.003 | Windows ServiceSub-technique | SILENTTRINITY can establish persistence by creating a new service.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1069.001 | Local GroupsSub-technique | SILENTTRINITY can obtain a list of local groups and members.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1685 | Disable or Modify Tools | SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1113 | Screen Capture | SILENTTRINITY can take a screenshot of the current desktop.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1047 | Windows Management Instrumentation | SILENTTRINITY can use WMI for lateral movement.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1055 | Process Injection | SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1112 | Modify Registry | SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1124 | System Time Discovery | SILENTTRINITY can collect start time information from a compromised host.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1546.003 | Windows Management Instrumentation Event SubscriptionSub-technique | SILENTTRINITY can create a WMI Event to execute a payload for persistence.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1134.001 | Token Impersonation/TheftSub-technique | SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1556 | Modify Authentication Process | SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1012 | Query Registry | SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1689 | Downgrade Attack | SILENTTRINITY can downgrade NTLM to capture NTLM hashes.CitationGithub_SILENTTRINITY |
| Enterprise | T1087.002 | Domain AccountSub-technique | SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1018 | Remote System Discovery | SILENTTRINITY can enumerate and collect the properties of domain computers.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1690 | Prevent Command History Logging | SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1070.004 | File DeletionSub-technique | SILENTTRINITY can remove files from the compromised host.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1134.003 | Make and Impersonate TokenSub-technique | SILENTTRINITY can make tokens from known credentials.CitationGithub_SILENTTRINITY |
| Enterprise | T1059.006 | PythonSub-technique | SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.[1]CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1046 | Network Service Discovery | SILENTTRINITY can scan for open ports on a compromised machine.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1059.001 | PowerShellSub-technique | SILENTTRINITY can use PowerShell to execute commands.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1106 | Native API | SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1558.003 | KerberoastingSub-technique | SILENTTRINITY contains a module to conduct Kerberoasting.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1546.015 | Component Object Model HijackingSub-technique | SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32")`.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1041 | Exfiltration Over C2 Channel | SILENTTRINITY can transfer files from an infected host to the C2 server.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1555.004 | Windows Credential ManagerSub-technique | SILENTTRINITY can gather Windows Vault credentials.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1021.003 | Distributed Component Object ModelSub-technique | SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1083 | File and Directory Discovery | SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1680 | Local Storage Discovery | SILENTTRINITY can collect information related to a compromised host, including a list of drives.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1548.002 | Bypass User Account ControlSub-technique | SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1559.001 | Component Object ModelSub-technique | SILENTTRINITY can insert malicious shellcode into Excel.exe using a `Microsoft.Office.Interop` object.CitationGithub_SILENTTRINITY |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1010 | Application Window Discovery | SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1021.006 | Windows Remote ManagementSub-technique | SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | SILENTTRINITY can establish a LNK file in the startup folder for persistence.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1057 | Process Discovery | SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1056.002 | GUI Input CaptureSub-technique | SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1056.001 | KeyloggingSub-technique | SILENTTRINITY has a keylogging capability.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1033 | System Owner/User Discovery | SILENTTRINITY can gather a list of logged on users.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.[2] |
| Enterprise | T1082 | System Information Discovery | SILENTTRINITY can collect information related to a compromised host, including OS version.CitationGitHub SILENTTRINITY Modules July 2019 |
| Enterprise | T1007 | System Service Discovery | SILENTTRINITY can search for modifiable services that could be used for privilege escalation.CitationGitHub SILENTTRINITY Modules July 2019 |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Current bundle | 0c1c78c2627c… | ||
| 19.2 | 1.1 | Older bundle | 0c1c78c2627c… | ||
| 19.1 | 1.1 | Older bundle | 0c1c78c2627c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]GitHub SILENTTRINITY March 2022
Salvati, M (2019, August 6). SILENTTRINITY. Retrieved March 23, 2022.
Open source URL - [2]Security Affairs SILENTTRINITY July 2019
Paganini, P. (2019, July 7). Croatia government agencies targeted with news SilentTrinity malware. Retrieved March 23, 2022.
Open source URL - [3]SILENTTRINITY
(Citation: GitHub SILENTTRINITY March 2022)
- [4]mitre-attackS0692Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.