TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|

TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

TEMP.Veles has used scheduled task XML triggers.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.012|Image File Execution Options Injection|

TEMP.Veles has modified and added entries within

TEMP.Veles has used

Mimikatz and a custom tool, SecHack, to harvest credentials. (Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.(Citation: FireEye TRITON 2019)
|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server|T0886|Remote Services|

TEMP.Veles utilized remote desktop protocol (RDP) jump boxes to move into the ICS environment. (Citation: Dragos December 2017)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

TEMP.Veles utilizes watering hole websites to target industrial employees. (Citation: Chris Bing May 2018)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0862|Supply Chain Compromise|