FrameworkPOS

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Stats

First seen: March 2022
Last seen: September 2026

Also known as

Trinity

MITRE ATT&CK techniques

5 techniques across 3 tactics.

TA0007 Discovery

T1057Process Discovery

TA0009 Collection

T1005Data from Local System
T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0010 Exfiltration

T1048Exfiltration Over Alternative Protocol

Associated groups

G0037FIN6

Alert name variants

Alert Name	Engine
DeepScan:Generic.Trinity.1.AF3E6A7D	AV
Win32.Spyware.FrameworkPOS	ATP Sandbox Adv. Heuristics
Win32.Trojan.FrameworkPOS	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.FrameworkPoS malicious executable download attempt	IPS-SWG

Related families

Ramsay InvisiMole Machete SombRAT InvisibleFerret