{ "type": "bundle", "id": "bundle--e9cbfd8d-5dfa-5ea4-b80a-ada7602bbc10", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "name": "APT15", "aliases": [ "APT15", "VIXEN PANDA", "Ke3Chang", "Playful Dragon", "Metushy", "Lurid", "Social Network Team", "Royal APT", "BRONZE PALACE", "BRONZE DAVENPORT", "BRONZE IDLEWOOD", "NICKEL", "Red Vulture", "Nylon Typhoon", "Mirage", "RIVER CASTLE", "GREF", "RoyalAPT" ], "description": "This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.", "resource_level": "government", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0004", "url": "https://attack.mitre.org/groups/G0004/" }, { "source_name": "skopnix", "external_id": "apt15", "url": "https://skopnix.com/actors/apt15" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html" }, { "source_name": "arstechnica.com", "url": "http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/" }, { "source_name": "github.com", "url": "https://github.com/nccgroup/Royal_APT" }, { "source_name": "cfr.org", "url": "https://www.cfr.org/interactive/cyber-operations/mirage" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf" }, { "source_name": "unit42.paloaltonetworks.com", "url": "https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/" }, { "source_name": "research.nccgroup.com", "url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/" }, { "source_name": "intezer.com", "url": "https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/" }, { "source_name": "secureworks.com", "url": "https://www.secureworks.com/research/threat-profiles/bronze-palace" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/insights/apt-groups" }, { "source_name": "pwc.com", "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf" }, { "source_name": "query.prod.cms.rt.microsoft.com", "url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi" }, { "source_name": "bsi.bund.de", "url": "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0004" }, { "source_name": "learn.microsoft.com", "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide" }, { "source_name": "microsoft.com", "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe" }, { "source_name": "web.archive.org", "url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a7f0e4ed-6850-5ff5-8375-45afd5cd01e9", "name": "Botnet", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.005", "url": "https://attack.mitre.org/techniques/T1583/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1569.002", "url": "https://attack.mitre.org/techniques/T1569/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766", "name": "External Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.003", "url": "https://attack.mitre.org/techniques/T1543/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--80fa4b95-0531-500b-85ae-1316ac3cda1b", "name": "Right-to-Left Override", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.002", "url": "https://attack.mitre.org/techniques/T1036/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "name": "Match Legitimate Resource Name or Location", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "name": "Cloud Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4", "name": "Deobfuscate/Decode Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1140", "url": "https://attack.mitre.org/techniques/T1140/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc", "name": "LSASS Memory", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.001", "url": "https://attack.mitre.org/techniques/T1003/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b", "name": "Security Account Manager", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.002", "url": "https://attack.mitre.org/techniques/T1003/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c", "name": "NTDS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.003", "url": "https://attack.mitre.org/techniques/T1003/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671", "name": "LSA Secrets", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.004", "url": "https://attack.mitre.org/techniques/T1003/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c1da3a4b-97b4-57bd-8af1-7d975c07aea5", "name": "Golden Ticket", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1558.001", "url": "https://attack.mitre.org/techniques/T1558/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662", "name": "System Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1007", "url": "https://attack.mitre.org/techniques/T1007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1033", "url": "https://attack.mitre.org/techniques/T1033/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5", "name": "System Network Connections Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1049", "url": "https://attack.mitre.org/techniques/T1049/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3", "name": "Domain Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069.002", "url": "https://attack.mitre.org/techniques/T1069/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.001", "url": "https://attack.mitre.org/techniques/T1087/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2682aa8e-8984-5b16-9650-036bac89f65c", "name": "System Language Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1614.001", "url": "https://attack.mitre.org/techniques/T1614/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590", "name": "Keylogging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1056.001", "url": "https://attack.mitre.org/techniques/T1056/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d", "name": "Remote Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.002", "url": "https://attack.mitre.org/techniques/T1114/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab", "name": "Automated Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1119", "url": "https://attack.mitre.org/techniques/T1119/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6", "name": "Sharepoint", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.002", "url": "https://attack.mitre.org/techniques/T1213/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e", "name": "Archive Collected Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560", "url": "https://attack.mitre.org/techniques/T1560/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9", "name": "Archive via Utility", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.001", "url": "https://attack.mitre.org/techniques/T1560/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522", "name": "DNS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.004", "url": "https://attack.mitre.org/techniques/T1071/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366", "name": "Automated Exfiltration", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1020", "url": "https://attack.mitre.org/techniques/T1020/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--2226b1f9-4fcb-5c21-a480-cb461aeba235", "name": "Okrum", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0439", "url": "https://attack.mitre.org/software/S0439/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--bdd6bba2-3f1f-5765-b330-aedb6c0ccb43", "name": "MirageFox", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0280", "url": "https://attack.mitre.org/software/S0280/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--8ff54144-88cb-57f4-b722-88413214658e", "name": "Neoichor", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0691", "url": "https://attack.mitre.org/software/S0691/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--1a35e4fb-befb-57ef-a774-5fe51e6e6d0b", "name": "Ping", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0097", "url": "https://attack.mitre.org/software/S0097/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c", "name": "Systeminfo", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0096", "url": "https://attack.mitre.org/software/S0096/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236", "name": "netstat", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0104", "url": "https://attack.mitre.org/software/S0104/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--112702bc-aaad-5807-9496-d9aceea6d3ab", "name": "spwebmember", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0227", "url": "https://attack.mitre.org/software/S0227/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--b044b2da-26b8-547a-9b3f-35b763fce3ab", "name": "Tasklist", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0057", "url": "https://attack.mitre.org/software/S0057/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d", "name": "Net", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0039", "url": "https://attack.mitre.org/software/S0039/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632", "name": "ipconfig", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0100", "url": "https://attack.mitre.org/software/S0100/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cd93a7c6-5277-5df8-a9c0-da826b953094", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--a7f0e4ed-6850-5ff5-8375-45afd5cd01e9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--370e7111-9e95-5877-b68e-ef6437073ca1", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--96b3407d-26eb-5502-bd45-2a5c7b078da8", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3810d86c-e130-54d8-8a71-efb6803e2469", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7ad748ae-06f1-5368-9efe-cde82c36aeda", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3c9194e8-cd4e-5e3c-8f5e-2d153260d586", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8f0a1ceb-505f-5e79-9319-453fc05352e8", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fcb4ca8a-64bb-5b43-a916-e5a58fa69e90", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f8297cff-13b5-5a90-8a97-3b73d016edfa", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--03a92b06-a34d-5cc6-80e2-bc5bc647448f", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--59fd56ce-36be-597a-a898-e8e546141d86", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e9fb947c-6e9a-5fce-8c60-d616ef0bce7a", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--80fa4b95-0531-500b-85ae-1316ac3cda1b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e63ad81e-a697-5594-ac80-477986859f49", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2d751ffd-22ac-5e37-a87d-87cb96bfed58", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9bf587a1-dcd6-53f5-87d8-c636758e14be", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--725a6e7f-072a-5195-9e80-19a29689da40", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d8a78eb8-f67b-5632-a436-5a56d0ed703b", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ad82e5bf-956e-5748-bf4a-6b9b13fb66ea", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8c396597-eef2-5d5f-ba91-85ec1f974450", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4a09ec09-f27e-55f9-bc50-b5fc9befabda", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9cebce26-d7d6-58e3-94ce-45113d4a37ee", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--c1da3a4b-97b4-57bd-8af1-7d975c07aea5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--87b27a1b-e3a3-51dc-a31c-ddf9369f3569", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fa40aa09-901d-5ee7-8c28-1c2e8f2bb0c7", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fc0f3c94-7ca8-5c3c-8ba9-93684ae4318a", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--feeb46dc-6956-510b-a741-68916bc7c044", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--58322ebe-4650-58dc-8bbd-5f555ae346ed", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--45a32c36-ad84-5ea3-880d-00650a6041d9", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9ae15d80-b962-5fca-8d93-f617e58d3a81", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5ea2a0d4-89d0-57db-946c-705947ccffcb", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dfb668d2-d2c8-5ef4-bcac-f6179ff600d9", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a111d915-c3e7-510c-bcd9-0c609373fec5", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--26a7a0d1-a5b6-50ba-b36e-5e1807b9312c", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dba9d2be-3899-57f4-a752-577b512ef1bd", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--2682aa8e-8984-5b16-9650-036bac89f65c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0c98c957-9a26-5a4b-beb9-2f734eaf81d3", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--49bb9958-36ae-5183-b174-a6a5fbd6417e", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--02aa0b26-6282-5c1c-ba92-555011779cbf", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--010f494b-16de-5559-820b-9efdd01d1796", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c9b6a1e7-aab0-5533-8fba-5cbc73552d40", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--238977fc-d99a-581f-b1d9-36d6c2aec44c", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ce3c7bc1-7910-5746-8c75-8dd468c6f75e", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--48bee27c-06e7-5883-9b27-093853b67a5c", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bc3c751d-90e2-579c-bf20-38a8d4762664", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--09598645-4dab-5103-a8ee-dd156f85764f", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--856e2ac9-74a6-5261-80df-493796d6225b", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fdb26476-352b-5a2a-89b5-7620e3cf0403", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b4e3fb4a-bdd8-5286-989e-52ed99887644", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f314c24e-f07e-576d-bfe9-6dc555e8d1a8", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "malware--2226b1f9-4fcb-5c21-a480-cb461aeba235" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ee084100-60f0-5d32-ba80-0270f587cb44", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "malware--bdd6bba2-3f1f-5765-b330-aedb6c0ccb43" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--661c6a52-72eb-50c2-8a6b-bfc5a2c31cb5", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "malware--8ff54144-88cb-57f4-b722-88413214658e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--579e0591-e695-5f48-8883-9ddcecfa4603", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--1a35e4fb-befb-57ef-a774-5fe51e6e6d0b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--96105d89-bf0a-51f8-91bc-42b7cad87c43", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--12597ee6-5349-5cca-bf0b-de5bfca73a03", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2af7ddc1-8797-5546-a0db-ddbb16b63981", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--112702bc-aaad-5807-9496-d9aceea6d3ab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--944aa2da-8cea-5e04-8413-27cafdde29d9", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--43aa41ea-a571-59ea-8c10-44c5e8c23d18", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--b044b2da-26b8-547a-9b3f-35b763fce3ab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a1e14e44-29a4-585d-a9a5-f23c4495befa", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--238f4236-75ab-557c-ac5f-ae122c04ae57", "relationship_type": "uses", "source_ref": "intrusion-set--7a49143b-e3d5-51a7-bfa2-6a6d4ac9c39d", "target_ref": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632" } ] }