{
  "type": "bundle",
  "id": "bundle--002c42ef-e6b6-5f34-86ea-ee945188e930",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "name": "APT23",
      "aliases": [
        "APT23",
        "PIRATE PANDA",
        "KeyBoy",
        "Tropic Trooper",
        "BRONZE HOBART",
        "Red Orthrus",
        "Earth Centaur"
      ],
      "description": "TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0081",
          "url": "https://attack.mitre.org/groups/G0081/"
        },
        {
          "source_name": "skopnix",
          "external_id": "apt23",
          "url": "https://skopnix.com/actors/apt23"
        },
        {
          "source_name": "blog.rapid7.com",
          "url": "https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "http://www.crowdstrike.com/blog/rhetoric-foreshadows-cyber-activity-in-the-south-china-sea/"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        },
        {
          "source_name": "researchcenter.paloaltonetworks.com",
          "url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        },
        {
          "source_name": "trendmicro.com",
          "url": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-tropic-trooper.pdf"
        },
        {
          "source_name": "blog.trendmicro.com",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        },
        {
          "source_name": "blog.lookout.com",
          "url": "https://blog.lookout.com/titan-mobile-threat"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/bronze-hobart"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/insights/apt-groups"
        },
        {
          "source_name": "pwc.co.uk",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0081"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/"
        },
        {
          "source_name": "documents.trendmicro.com",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        },
        {
          "source_name": "researchcenter.paloaltonetworks.com",
          "url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61",
      "name": "Native API",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1106",
          "url": "https://attack.mitre.org/techniques/T1106/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d",
      "name": "Exploitation for Client Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1203",
          "url": "https://attack.mitre.org/techniques/T1203/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d",
      "name": "Web Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.003",
          "url": "https://attack.mitre.org/techniques/T1505/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bca848f8-30b3-5ba3-a072-4b00e75ea812",
      "name": "Winlogon Helper DLL",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.004",
          "url": "https://attack.mitre.org/techniques/T1547/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e4d8283c-30d7-55a5-bed1-99070ccc69be",
      "name": "Steganography",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.003",
          "url": "https://attack.mitre.org/techniques/T1027/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd",
      "name": "Encrypted/Encoded File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.013",
          "url": "https://attack.mitre.org/techniques/T1027/013/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db",
      "name": "Match Legitimate Resource Name or Location",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--025157ae-afbb-5d61-8414-c12aab6084cd",
      "name": "Dynamic-link Library Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.001",
          "url": "https://attack.mitre.org/techniques/T1055/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208",
      "name": "File Deletion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777",
      "name": "Local Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.003",
          "url": "https://attack.mitre.org/techniques/T1078/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4",
      "name": "Deobfuscate/Decode Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--937c936c-dad1-5473-9a9c-1096e11efd5f",
      "name": "Template Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1221",
          "url": "https://attack.mitre.org/techniques/T1221/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--659798b2-e80a-5489-9042-ceced73bf67e",
      "name": "Hidden Files and Directories",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.001",
          "url": "https://attack.mitre.org/techniques/T1564/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5",
      "name": "DLL",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1574.001",
          "url": "https://attack.mitre.org/techniques/T1574/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce",
      "name": "Network Service Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1046",
          "url": "https://attack.mitre.org/techniques/T1046/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5",
      "name": "System Network Connections Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1049",
          "url": "https://attack.mitre.org/techniques/T1049/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
      "name": "Process Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b",
      "name": "File and Directory Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1083",
          "url": "https://attack.mitre.org/techniques/T1083/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044",
      "name": "Network Share Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1135",
          "url": "https://attack.mitre.org/techniques/T1135/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8700a7a3-05ec-5658-b111-1ed75d9321cb",
      "name": "Software Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1518",
          "url": "https://attack.mitre.org/techniques/T1518/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526",
      "name": "Security Software Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1518.001",
          "url": "https://attack.mitre.org/techniques/T1518/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca",
      "name": "Local Storage Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1680",
          "url": "https://attack.mitre.org/techniques/T1680/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a867694a-d7d7-5659-b0a1-cc7d3b42605f",
      "name": "Replication Through Removable Media",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1091",
          "url": "https://attack.mitre.org/techniques/T1091/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab",
      "name": "Automated Collection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1119",
          "url": "https://attack.mitre.org/techniques/T1119/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522",
      "name": "DNS",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.004",
          "url": "https://attack.mitre.org/techniques/T1071/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1d031457-774a-5a6d-8185-83dcedf708f0",
      "name": "Standard Encoding",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1132.001",
          "url": "https://attack.mitre.org/techniques/T1132/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dc23ed3b-430a-524c-80c0-c7f222ddbd86",
      "name": "Encrypted Channel",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573",
          "url": "https://attack.mitre.org/techniques/T1573/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed",
      "name": "Asymmetric Cryptography",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.002",
          "url": "https://attack.mitre.org/techniques/T1573/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366",
      "name": "Automated Exfiltration",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1020",
          "url": "https://attack.mitre.org/techniques/T1020/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8aba9f9b-3cd3-51e7-bfe3-88b186a6e63e",
      "name": "Exfiltration over USB",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1052.001",
          "url": "https://attack.mitre.org/techniques/T1052/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--1675d9da-c4d3-5d8f-a808-36ba945b05ee",
      "name": "USBferry",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0452",
          "url": "https://attack.mitre.org/software/S0452/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--2f4b5d47-7abf-50d5-a877-7e1df8a17777",
      "name": "ShadowPad",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0596",
          "url": "https://attack.mitre.org/software/S0596/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--ad49e37d-ab20-5923-9b29-cffa166cd5ac",
      "name": "PoisonIvy",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0012",
          "url": "https://attack.mitre.org/software/S0012/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--af3b8200-5205-579f-8ab6-f3fafd25183e",
      "name": "YAHOYAH",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0388",
          "url": "https://attack.mitre.org/software/S0388/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--ac3957f3-ba86-544a-980e-7e445838519a",
      "name": "KeyBoy",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0387",
          "url": "https://attack.mitre.org/software/S0387/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--e04f50b0-3ab0-56d1-a8a9-f4907a3c5a9a",
      "name": "BITSAdmin",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0190",
          "url": "https://attack.mitre.org/software/S0190/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--04955ccf-bd96-5a57-9280-d9674eff7c10",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5aaebe82-9d0f-5f08-8d37-8113ed6661e0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--10a9aba6-3182-5dfc-8814-a5696bf10a9b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--81c600f6-b6d2-5161-8ef1-08dce5cb8a20",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--54bbc588-9d67-5cc4-83eb-2af0c9e3ed36",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5e124d3b-73e2-550b-a38c-c5e447302033",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cd1c9d69-862f-560f-a569-ca73194a492d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--06f6a18c-6870-5744-b646-7f75019a5b0a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fe2bec76-e201-51e1-a40b-4707633d70be",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--bca848f8-30b3-5ba3-a072-4b00e75ea812"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--49bbd0d2-111f-5f03-9157-5a6a3a35f4cf",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--e4d8283c-30d7-55a5-bed1-99070ccc69be"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e0e0f7cb-fe06-5f77-90d8-9c01a017cdf2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--26a97110-2827-59b5-8e4b-fff50f26fe2e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c50f6b18-f87a-52b8-a840-370119e86b51",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--025157ae-afbb-5d61-8414-c12aab6084cd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e571c940-2755-5aff-b0db-9e278302203d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2abfd1f2-83d0-5a4a-8077-3babe4ad76b9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ec200622-fbc8-5c4f-a6f0-be851fbc6511",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0dae347c-f366-53e9-a055-0646720d56b7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--937c936c-dad1-5473-9a9c-1096e11efd5f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--99d44ade-59cb-53a4-820b-aa09ec36f5c4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--659798b2-e80a-5489-9042-ceced73bf67e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a54f7a34-8ff5-5985-9c5d-fcc179b71c74",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5d20ad8b-a779-57a9-93aa-ecd253cc85bf",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b10bb1d1-4ae6-53b9-bb06-755ae21238e0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bc8adbe3-a6c0-5957-ae2b-6a296ad9f845",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1dfcce50-42fb-56f6-a6eb-b561bc6bca1e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--80b74000-421d-516f-a1b1-eba42d853544",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ca6489c3-9464-56aa-b937-fe1c40c053d7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d24f3a01-21eb-5f05-b7e4-f1e38afd219b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0c2870bd-f944-5366-8e0c-be84a72b23db",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7be20a79-9841-5960-aeef-0b249caff96f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--8700a7a3-05ec-5658-b111-1ed75d9321cb"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6f5372f2-a7b2-5469-bfc7-2b83021f2d9f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--72ddb120-6dd8-527d-9a3d-8173a49bad0d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3ea19604-7863-5ce1-8c49-c39e266e9264",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--a867694a-d7d7-5659-b0a1-cc7d3b42605f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bf47d71f-44f6-5952-8a07-e28731b940d2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1a6bc27d-eab4-569d-8127-88f154bf5df3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--04affd98-41ff-5468-9253-86e40a15b612",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4497b3e3-2a61-5a09-9b1c-dcbd2a817d1a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6865ff42-60dd-57ba-a43f-6c88312b9ab3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--1d031457-774a-5a6d-8185-83dcedf708f0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--43a45ab6-f34a-5cec-80d9-d606214c6d04",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--dc23ed3b-430a-524c-80c0-c7f222ddbd86"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2435b43c-54f9-52ec-9185-502a514b4161",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d3d97063-69a2-5364-994c-fe0311213ed1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3b15a41e-347e-51fd-9d72-ff380b13b0f3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "attack-pattern--8aba9f9b-3cd3-51e7-bfe3-88b186a6e63e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5ac6d0d5-3f69-5119-91c9-28ae428302b3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "malware--1675d9da-c4d3-5d8f-a808-36ba945b05ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--28a897f3-d83d-5333-ba91-cc9d9754b639",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "malware--2f4b5d47-7abf-50d5-a877-7e1df8a17777"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--618f7af3-44ec-5257-9d44-4670ce96ff49",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "malware--ad49e37d-ab20-5923-9b29-cffa166cd5ac"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0652917a-f105-5b66-bcf0-2ce232f6a127",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "malware--af3b8200-5205-579f-8ab6-f3fafd25183e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fb03ee30-e267-543b-b3b8-0c4d5e82240a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "malware--ac3957f3-ba86-544a-980e-7e445838519a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0f66c8a8-b075-51a7-b78b-8dcf10821cd2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--6d750441-9c27-542a-bc9a-f5b8a5f37059",
      "target_ref": "tool--e04f50b0-3ab0-56d1-a8a9-f4907a3c5a9a"
    }
  ]
}