TRITON framework recovered during Mandiant ICS incident response

Hunt Hypothesis

This hunt targets adversaries leveraging the TRITOT framework to execute sophisticated industrial control system attacks similar to those identified in Mandiant’s recent incident response engagements. Proactively searching for these artifacts within Azure Sentinel is critical because early detection of this specific framework can reveal targeted ICS compromises before they escalate into operational disruptions or safety incidents.

YARA Rule

rule TRITON_ICS_FRAMEWORK
{
      meta:
          author = "nicholas.carr @itsreallynick"
          md5 = "0face841f7b2953e7c29c064d6886523"
          description = "TRITON framework recovered during Mandiant ICS incident response"
      strings:
          $python_compiled = ".pyc" nocase ascii wide
          $python_module_01 = "__module__" nocase ascii wide
          $python_module_02 = "<module>" nocase ascii wide
          $python_script_01 = "import Ts" nocase ascii wide
          $python_script_02 = "def ts_" nocase ascii wide  

          $py_cnames_01 = "TS_cnames.py" nocase ascii wide
          $py_cnames_02 = "TRICON" nocase ascii wide
          $py_cnames_03 = "TriStation " nocase ascii wide
          $py_cnames_04 = " chassis " nocase ascii wide  

          $py_tslibs_01 = "GetCpStatus" nocase ascii wide
          $py_tslibs_02 = "ts_" ascii wide
          $py_tslibs_03 = " sequence" nocase ascii wide
          $py_tslibs_04 = /import Ts(Hi|Low|Base)[^:alpha:]/ nocase ascii wide
          $py_tslibs_05 = /module\s?version/ nocase ascii wide
          $py_tslibs_06 = "bad " nocase ascii wide
          $py_tslibs_07 = "prog_cnt" nocase ascii wide  

          $py_tsbase_01 = "TsBase.py" nocase ascii wide
          $py_tsbase_02 = ".TsBase(" nocase ascii wide 
         
          $py_tshi_01 = "TsHi.py" nocase ascii wide
          $py_tshi_02 = "keystate" nocase ascii wide
          $py_tshi_03 = "GetProjectInfo" nocase ascii wide
          $py_tshi_04 = "GetProgramTable" nocase ascii wide
          $py_tshi_05 = "SafeAppendProgramMod" nocase ascii wide
          $py_tshi_06 = ".TsHi(" ascii nocase wide  

          $py_tslow_01 = "TsLow.py" nocase ascii wide
          $py_tslow_02 = "print_last_error" ascii nocase wide
          $py_tslow_03 = ".TsLow(" ascii nocase wide
          $py_tslow_04 = "tcm_" ascii wide
          $py_tslow_05 = " TCM found" nocase ascii wide  

          $py_crc_01 = "crc.pyc" nocase ascii wide
          $py_crc_02 = "CRC16_MODBUS" ascii wide
          $py_crc_03 = "Kotov Alaxander" nocase ascii wide
          $py_crc_04 = "CRC_CCITT_XMODEM" ascii wide
          $py_crc_05 = "crc16ret" ascii wide
          $py_crc_06 = "CRC16_CCITT_x1D0F" ascii wide
          $py_crc_07 = /CRC16_CCITT[^_]/ ascii wide  

          $py_sh_01 = "sh.pyc" nocase ascii wide  

          $py_keyword_01 = " FAILURE" ascii wide
          $py_keyword_02 = "symbol table" nocase ascii wide  

          $py_TRIDENT_01 = "inject.bin" ascii nocase wide
          $py_TRIDENT_02 = "imain.bin" ascii nocase wide  

      condition:
          2 of ($python_*) and 7 of ($py_*) and filesize < 3MB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 41 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the TRITON framework recovery detection rule within an enterprise environment, along with suggested filters and exclusions:

• Scheduled Integrity Scans by Tripwire Enterprise or McAfee ICS Security

  • Scenario: During nightly maintenance windows, security agents (e.g., Tripwire Enterprise) perform deep integrity scans on the OT network. These agents often re-mount or “recover” the TRITON framework directory structure to verify file hashes and digital signatures against a known baseline, mimicking the recovery behavior seen during an active incident response.
  • Filter/Exclusion: Exclude events where the Source Process is twagent.exe (Tripwire) or mcafeefw.exe AND the Event Type indicates “Scheduled Scan” rather than “Incident Response.” Additionally, filter by time to exclude occurrences strictly between 02:00 and 04:00 UTC.

• Mandiant ICS Agent Health Checks and Self-Healing Routines

  • Scenario: The Mandiant ICS agent itself runs periodic self-healing routines (every 6 hours) to ensure its own monitoring hooks are active. If the agent detects a minor drift in the TRITON framework configuration files, it automatically triggers a local recovery sequence without human intervention or an actual threat alert from the SOC.
  • Filter/Exclusion: Create a rule exclusion for events where the User Account is the system service account (e.g., MandiantICS_Svc) AND the Initiation Method is marked as “Automated Health Check.” Exclude logs containing specific internal event IDs associated with routine self-healing (e.g., Event ID 1045).

• Configuration Management Updates via Ansible or SCCM

  • Scenario: During patch Tuesday cycles, IT automation