Threat intelligence / Tool

SILENTTRINITY

[SILENTTRINITY](https://attack.mitre.org/software/S0692) is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. [SILENTTRINITY](https://attack.mitre.org/software/S0692) was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.(Citation: GitHub SILENTTRINITY March 2022)(Citation: Security Affairs SILENTTRINITY July 2019)

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SILENTTRINITY](https://attack.mitre.org/software/S0692) is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. [SILENTTRINITY](https://attack.mitre.org/software/S0692) was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.(Citation: GitHub SILENTTRINITY March 2022)(Citation: Security Affairs SILENTTRINITY July 2019)

Labels

tool

53 recorded

Relationships

uses

to Application Window Discovery

Technique

uses

to Bypass User Account Control

Technique

uses

to Change Default File Association

Technique

uses

to Clipboard Data

Technique

uses

to Component Object Model

Technique

uses

to Component Object Model Hijacking

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Disable or Modify Tools

Technique

uses

to Distributed Component Object Model

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to Downgrade Attack

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Group Policy Preferences

Technique

uses

to GUI Input Capture

Technique

uses

to Hidden Window

Technique

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Kerberoasting

Technique

uses

Technique

uses

to Local Groups

Technique

uses

to Local Storage Discovery

Technique

uses

to LSASS Memory

Technique

uses

to Make and Impersonate Token

Technique

uses

to Modify Authentication Process

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

Technique

uses

to Prevent Command History Logging

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

Technique

uses

to Query Registry

Technique

uses

to Reflective Code Loading

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Credential Manager

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

to Windows Remote Management

Technique

uses

to Windows Service

Technique

4 external

References

mitre-attack

S0692

SILENTTRINITY

—

Security Affairs SILENTTRINITY July 2019

https://securityaffairs.co/wordpress/88021/apt/croatia-government-silenttrinity-malware.html

GitHub SILENTTRINITY March 2022

https://github.com/byt3bl33d3r/SILENTTRINITY