{ "type": "bundle", "id": "bundle--d3302cca-e305-55e3-8859-e7a9b1b256da", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "name": "APT29", "aliases": [ "APT29", "Group 100", "COZY BEAR", "The Dukes", "Minidionis", "SeaDuke", "YTTRIUM", "IRON HEMLOCK", "Grizzly Steppe", "ATK7", "Cloaked Ursa", "TA421", "Blue Kitsune", "ITG11", "BlueBravo", "Nobelium", "UAC-0029", "ICECAP", "ICE RELIC", "IRON RITUAL", "NobleBaron", "Dark Halo", "UNC2452", "CozyDuke", "SolarStorm", "UNC3524", "Midnight Blizzard" ], "description": "A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of State, Pentagon, and the Joint Chiefs of Staff. The threat actor includes all of the Dukes tool sets, including MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke (aka MiniDionis), and HammerDuke (aka Hammertoss). '", "resource_level": "government", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0016", "url": "https://attack.mitre.org/groups/G0016/" }, { "source_name": "skopnix", "external_id": "apt29", "url": "https://skopnix.com/actors/apt29" }, { "source_name": "labsblog.f-secure.com", "url": "https://labsblog.f-secure.com/2015/09/17/the-dukes-7-years-of-russian-cyber-espionage/" }, { "source_name": "www2.fireeye.com", "url": "https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf" }, { "source_name": "us-cert.gov", "url": "https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html" }, { "source_name": "cfr.org", "url": "https://www.cfr.org/interactive/cyber-operations/dukes" }, { "source_name": "pylos.co", "url": "https://pylos.co/2018/11/18/cozybear-in-from-the-cold/" }, { "source_name": "cloudblogs.microsoft.com", "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/" }, { "source_name": "secureworks.com", "url": "https://www.secureworks.com/research/threat-profiles/iron-hemlock" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0016" }, { "source_name": "unit42.paloaltonetworks.com", "url": "https://unit42.paloaltonetworks.com/atoms/cloaked-ursa/" }, { "source_name": "go.recordedfuture.com", "url": "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf" }, { "source_name": "cip.gov.ua", "url": "https://cip.gov.ua/services/cm/api/attachment/download?id=60068" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/" }, { "source_name": "crowdstrike.com", "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/" }, { "source_name": "volexity.com", "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/" }, { "source_name": "crowdstrike.com", "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/" }, { "source_name": "crowdstrike.com", "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/" }, { "source_name": "us-cert.gov", "url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "name": "Vulnerability Scanning", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1595.002", "url": "https://attack.mitre.org/techniques/T1595/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74", "name": "Web Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.006", "url": "https://attack.mitre.org/techniques/T1583/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db", "name": "Email Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1586.002", "url": "https://attack.mitre.org/techniques/T1586/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38367eac-0f18-5442-8338-a4df5bcad434", "name": "Cloud Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1586.003", "url": "https://attack.mitre.org/techniques/T1586/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be631a8d-2393-51fe-8c1c-4fe84d3992a9", "name": "Digital Certificates", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.003", "url": "https://attack.mitre.org/techniques/T1587/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e", "name": "Trusted Relationship", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9", "name": "Spearphishing Attachment", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.001", "url": "https://attack.mitre.org/techniques/T1566/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801", "name": "Spearphishing Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.002", "url": "https://attack.mitre.org/techniques/T1566/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd", "name": "Spearphishing via Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.003", "url": "https://attack.mitre.org/techniques/T1566/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.006", "url": "https://attack.mitre.org/techniques/T1059/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--db33eb90-8c3e-552b-a47f-606eb30f1283", "name": "Cloud API", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.009", "url": "https://attack.mitre.org/techniques/T1059/009/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d", "name": "Exploitation for Client Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1203", "url": "https://attack.mitre.org/techniques/T1203/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54", "name": "Malicious Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.001", "url": "https://attack.mitre.org/techniques/T1204/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890", "name": "Malicious File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--669c2c5b-dcf0-582a-8ca0-268ad149d608", "name": "Cloud Administration Command", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1651", "url": "https://attack.mitre.org/techniques/T1651/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cfada88d-bc4f-5985-8297-1132075f0497", "name": "Boot or Logon Initialization Scripts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1037", "url": "https://attack.mitre.org/techniques/T1037/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a13c057-07ef-582b-a900-b114106b3f2a", "name": "RC Scripts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1037.004", "url": "https://attack.mitre.org/techniques/T1037/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3c780d9c-5413-549a-be69-ac67620dc85c", "name": "Additional Email Delegate Permissions", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.002", "url": "https://attack.mitre.org/techniques/T1098/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--77799061-45e8-516b-83fe-082785445da8", "name": "Device Registration", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.005", "url": "https://attack.mitre.org/techniques/T1098/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766", "name": "External Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b2940dfc-768e-5b9a-aca2-94410acaec06", "name": "Cloud Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.003", "url": "https://attack.mitre.org/techniques/T1136/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.003", "url": "https://attack.mitre.org/techniques/T1505/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cf510372-fd84-5d42-9b95-a4148f92b476", "name": "Windows Management Instrumentation Event Subscription", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1546.003", "url": "https://attack.mitre.org/techniques/T1546/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--429368be-87a1-5cbc-9896-b5c63e303f8d", "name": "Accessibility Features", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1546.008", "url": "https://attack.mitre.org/techniques/T1546/008/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98", "name": "Bypass User Account Control", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1548.002", "url": "https://attack.mitre.org/techniques/T1548/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36cd6222-d7ad-5032-a8e6-57c5ccfdd3a1", "name": "Binary Padding", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.001", "url": "https://attack.mitre.org/techniques/T1027/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e", "name": "Software Packing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.002", "url": "https://attack.mitre.org/techniques/T1027/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--92890f75-ec80-50d4-b057-e136a5344491", "name": "HTML Smuggling", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.006", "url": "https://attack.mitre.org/techniques/T1027/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "name": "Match Legitimate Resource Name or Location", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c", "name": "Timestomp", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.006", "url": "https://attack.mitre.org/techniques/T1070/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777", "name": "Local Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.003", "url": "https://attack.mitre.org/techniques/T1078/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "name": "Cloud Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b29f4608-ddf5-559f-8251-d82aff3ee25a", "name": "Mshta", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1218.005", "url": "https://attack.mitre.org/techniques/T1218/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b", "name": "Security Account Manager", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.002", "url": "https://attack.mitre.org/techniques/T1003/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671", "name": "LSA Secrets", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.004", "url": "https://attack.mitre.org/techniques/T1003/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4eafa702-68b7-5c96-b175-c94d6a3b9819", "name": "Password Guessing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.001", "url": "https://attack.mitre.org/techniques/T1110/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "name": "Password Spraying", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.003", "url": "https://attack.mitre.org/techniques/T1110/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb", "name": "Steal Application Access Token", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1528", "url": "https://attack.mitre.org/techniques/T1528/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--41888906-2283-5bba-9d0d-fb742044633c", "name": "Multi-Factor Authentication Request Generation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1621", "url": "https://attack.mitre.org/techniques/T1621/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--76a0834e-5ada-528e-9a08-8c77779141b8", "name": "Steal or Forge Authentication Certificates", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1649", "url": "https://attack.mitre.org/techniques/T1649/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a61ebb75-2aaf-5138-8cf9-ae1fc98d45b4", "name": "Internet Connection Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016.001", "url": "https://attack.mitre.org/techniques/T1016/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3b5e4c98-f975-5f47-916c-50f9d031ea91", "name": "Cloud Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.004", "url": "https://attack.mitre.org/techniques/T1087/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--14a5d446-458a-518e-99fb-750a7b6a7c10", "name": "Cloud Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.007", "url": "https://attack.mitre.org/techniques/T1021/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c1489edc-3848-5126-81f8-8427d852d399", "name": "Pass the Ticket", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1550.003", "url": "https://attack.mitre.org/techniques/T1550/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d", "name": "Remote Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.002", "url": "https://attack.mitre.org/techniques/T1114/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--506b2f42-8b76-5a58-a3fd-750d2938f77c", "name": "External Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.002", "url": "https://attack.mitre.org/techniques/T1090/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246", "name": "Multi-hop Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.003", "url": "https://attack.mitre.org/techniques/T1090/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0ea06ae8-2525-59ab-a4b6-1f38988ecd7b", "name": "Domain Fronting", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.004", "url": "https://attack.mitre.org/techniques/T1090/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2b745188-a9c2-550d-894c-640e27442269", "name": "Dynamic Resolution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1568", "url": "https://attack.mitre.org/techniques/T1568/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dc23ed3b-430a-524c-80c0-c7f222ddbd86", "name": "Encrypted Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573", "url": "https://attack.mitre.org/techniques/T1573/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e126c5d3-7ff9-570d-9c87-a4839a56260a", "name": "Hide Infrastructure", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1665", "url": "https://attack.mitre.org/techniques/T1665/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cd473987-d7fd-5dba-aff5-76f723a16f9b", "name": "Mark-of-the-Web Bypass", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1553.005", "url": "https://attack.mitre.org/techniques/T1553/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a6b8ad39-bc76-5de8-b0c2-f01ed70e1401", "name": "Hybrid Identity", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1556.007", "url": "https://attack.mitre.org/techniques/T1556/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--626357a9-8190-520e-9388-5dc450bc8706", "name": "Disable or Modify Cloud Log", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685.002", "url": "https://attack.mitre.org/techniques/T1685/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--e7d445da-5f50-5e9f-8342-1888dfd49db5", "name": "PinchDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0048", "url": "https://attack.mitre.org/software/S0048/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--63f71b42-0a77-56af-85a8-3966cc8230a3", "name": "WellMail", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0515", "url": "https://attack.mitre.org/software/S0515/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--259a7b31-5991-5561-add0-adf6dffb4155", "name": "CozyCar", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0046", "url": "https://attack.mitre.org/software/S0046/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--7aefa95f-923f-593f-8402-bd9a491e0ff5", "name": "TrailBlazer", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0682", "url": "https://attack.mitre.org/software/S0682/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--be656865-8ffb-582c-a06a-c14d2fc9b7f6", "name": "OnionDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0052", "url": "https://attack.mitre.org/software/S0052/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--753b32e1-97d5-505d-8a68-8e029c1717aa", "name": "FatDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0512", "url": "https://attack.mitre.org/software/S0512/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--598af714-26f3-582a-a38f-9a2a49ca8ece", "name": "POSHSPY", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0150", "url": "https://attack.mitre.org/software/S0150/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--b9fa38de-6e7f-5cf2-b0ba-b4dec7452ca4", "name": "EnvyScout", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0634", "url": "https://attack.mitre.org/software/S0634/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--7d92c385-ee18-576e-8cb1-6d3ab402d72c", "name": "SoreFang", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0516", "url": "https://attack.mitre.org/software/S0516/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--65c5440d-2e57-5de6-b8c4-d9d4fb9cc9ed", "name": "GeminiDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0049", "url": "https://attack.mitre.org/software/S0049/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--f36919cc-b39f-5536-b19d-abd37b3d77c8", "name": "reGeorg", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1187", "url": "https://attack.mitre.org/software/S1187/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--5cf259eb-27a6-5902-9633-cea1eeafe3ac", "name": "GoldMax", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0588", "url": "https://attack.mitre.org/software/S0588/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--69f3500c-27e2-5a9d-aaf8-f9660057c5cb", "name": "FoggyWeb", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0661", "url": "https://attack.mitre.org/software/S0661/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--9b890574-b444-5cab-adb7-03ff3aa189b0", "name": "PolyglotDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0518", "url": "https://attack.mitre.org/software/S0518/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--bd2dc00e-aae8-584b-96bb-abda46316c64", "name": "MiniDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0051", "url": "https://attack.mitre.org/software/S0051/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--43482d3b-ba92-5155-8afd-fa9ade6e41f0", "name": "TEARDROP", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0560", "url": "https://attack.mitre.org/software/S0560/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--5d211ae7-9388-5b3b-8046-277289a8878d", "name": "SeaDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0053", "url": "https://attack.mitre.org/software/S0053/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--4f185ad3-80b0-5f30-8d3d-0f33fd124266", "name": "Sibot", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0589", "url": "https://attack.mitre.org/software/S0589/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--22f8042e-5054-5014-9b61-d6119c95cd71", "name": "Raindrop", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0565", "url": "https://attack.mitre.org/software/S0565/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--5a71efb4-3029-5a14-8104-994c4f3c2337", "name": "RegDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0511", "url": "https://attack.mitre.org/software/S0511/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--504fd0ec-e975-5e09-8e56-17db9aa0764b", "name": "CloudDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0054", "url": "https://attack.mitre.org/software/S0054/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--41ed084e-9975-567f-9473-a89aac19dc8e", "name": "GoldFinder", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0597", "url": "https://attack.mitre.org/software/S0597/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--4bb03019-1038-5daa-a834-5a576b205877", "name": "NativeZone", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0637", "url": "https://attack.mitre.org/software/S0637/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--21bdec3a-e699-5215-b7d5-cf788b5b1351", "name": "SUNSPOT", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0562", "url": "https://attack.mitre.org/software/S0562/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6", "name": "Cobalt Strike", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0154", "url": "https://attack.mitre.org/software/S0154/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--09c3dc33-61d5-5ac7-a336-868b0ef4a8dc", "name": "PowerDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0139", "url": "https://attack.mitre.org/software/S0139/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--f7510cb4-a7c0-5789-a181-b17688f05538", "name": "QUIETEXIT", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1084", "url": "https://attack.mitre.org/software/S1084/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--70894dbb-4486-5a14-9fb1-581c44030383", "name": "HAMMERTOSS", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0037", "url": "https://attack.mitre.org/software/S0037/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--b760c810-c217-575b-96cc-6def94dc4594", "name": "BoomBox", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0635", "url": "https://attack.mitre.org/software/S0635/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--01f078ea-f375-5e7e-8d3f-e0faaf8bf4a2", "name": "CosmicDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0050", "url": "https://attack.mitre.org/software/S0050/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--e046d243-2008-55d6-96aa-e2da13cc5234", "name": "SUNBURST", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0559", "url": "https://attack.mitre.org/software/S0559/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--38d1e202-1b8f-5d37-8550-dbb06c3e2969", "name": "WellMess", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0514", "url": "https://attack.mitre.org/software/S0514/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--ab05764c-4a9d-5fb5-b8d2-8b46b4dfbc3d", "name": "VaporRage", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0636", "url": "https://attack.mitre.org/software/S0636/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--a84897c7-29a3-57ef-b208-e41ee1d908b0", "name": "LiteDuke", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0513", "url": "https://attack.mitre.org/software/S0513/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--68911d04-978f-5b9b-b76f-299cccd73510", "name": "ROADTools", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0684", "url": "https://attack.mitre.org/software/S0684/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--59e6851b-ee01-5203-8bbe-914a99bad74f", "name": "meek", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0175", "url": "https://attack.mitre.org/software/S0175/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--b044b2da-26b8-547a-9b3f-35b763fce3ab", "name": "Tasklist", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0057", "url": "https://attack.mitre.org/software/S0057/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef", "name": "BloodHound", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0521", "url": "https://attack.mitre.org/software/S0521/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--15112c05-d113-5ad8-94da-02cf9e25d7ba", "name": "SDelete", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0195", "url": "https://attack.mitre.org/software/S0195/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c91e1e52-6ba3-5f66-bfd5-71375533ed55", "name": "AADInternals", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0677", "url": "https://attack.mitre.org/software/S0677/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d", "name": "AdFind", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0552", "url": "https://attack.mitre.org/software/S0552/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--3d48199b-75b1-51d4-8931-542698067cae", "name": "Tor", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0183", "url": "https://attack.mitre.org/software/S0183/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c", "name": "Systeminfo", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0096", "url": "https://attack.mitre.org/software/S0096/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632", "name": "ipconfig", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0100", "url": "https://attack.mitre.org/software/S0100/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8", "name": "Impacket", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0357", "url": "https://attack.mitre.org/software/S0357/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d", "name": "Net", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0039", "url": "https://attack.mitre.org/software/S0039/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--387ec776-926f-532f-bde6-2a3515615fc7", "name": "Sliver", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0633", "url": "https://attack.mitre.org/software/S0633/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6efb758c-480d-5a7a-ba4c-1c1195e69ffc", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--04a7d712-8cf8-58c2-b4a2-82b755862aa0", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--48e0d581-e3ed-5bac-baed-eb2ca1d64b0c", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9986735b-c151-54ef-9478-8a1b37602171", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--38367eac-0f18-5442-8338-a4df5bcad434" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1ca14022-25f0-5773-815d-a62f7a1b9603", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--571da5a3-582c-586c-ba51-0a58a7b74e65", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--be631a8d-2393-51fe-8c1c-4fe84d3992a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fdf40cbb-ca3a-546e-a5a4-e101cb1c053a", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fc5a3983-1b92-5058-8b66-0e266e73a3c2", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8210a530-27ea-5151-a6ae-b3b987763319", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--097696cd-5bea-5f8a-ad17-d589e0229334", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cec8a3ba-94b6-539f-85cc-e3a4751a707d", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fa2e3550-990b-508b-8ff4-199a5e2da98f", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f09856d7-7cd6-5879-98f2-374ac1b74d9d", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f57b5afd-15a7-5288-b923-012f93771a03", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fce962c5-3219-591c-ad75-dd23504aec6b", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--06befc5d-47d8-55c5-9fb1-6d7eb23206d2", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0a9c26d3-18b2-5a9a-929a-6ac97635e1ae", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--db33eb90-8c3e-552b-a47f-606eb30f1283" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9678a3be-c4dc-58dc-ac84-e75d2c7264bf", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5bf68eb6-57fd-524e-8bd9-1a8238b7e68d", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--df4de700-5d37-5439-a14c-08d40dde2b90", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5fc4e648-d732-5911-81b5-387bf8a8ad50", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--669c2c5b-dcf0-582a-8ca0-268ad149d608" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--455677c1-29f0-5b2a-9d94-1cfa3b5d764e", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--cfada88d-bc4f-5985-8297-1132075f0497" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7af2cf83-62e5-563f-a600-dc60db92217a", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--8a13c057-07ef-582b-a900-b114106b3f2a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ab99ae44-4fcb-5eff-b0aa-4b70cead430a", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--3c780d9c-5413-549a-be69-ac67620dc85c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d039f01f-1710-5378-b5c3-588e611305fc", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--77799061-45e8-516b-83fe-082785445da8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--24d0bc27-8445-5715-9718-36dcdb3e8bb6", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6a8a0c17-0c1b-5d33-b279-5b925b022b75", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--b2940dfc-768e-5b9a-aca2-94410acaec06" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ff82a35b-98c9-51dd-acec-48bc77b62646", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bee945e6-7d7d-5b71-89ef-9c9bca4865a6", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fd890c02-0715-5ae8-a191-ccc34df262a0", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--834b2fa3-7709-5558-8525-f35fb4ddf8c5", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--cf510372-fd84-5d42-9b95-a4148f92b476" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a4bfbc0a-fbc9-56af-aa41-39ff692849af", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--429368be-87a1-5cbc-9896-b5c63e303f8d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ac926c04-fadb-5c31-a9f1-556a84256dde", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ae6e977e-6a46-5a13-a929-f91c06f04072", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--36cd6222-d7ad-5032-a8e6-57c5ccfdd3a1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4f782ffd-f15c-53a6-b464-f02ce2849cea", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--269b2742-1665-5c34-9644-58fd2fef03ad", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--92890f75-ec80-50d4-b057-e136a5344491" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bc75fd73-e822-55d5-b819-9dc45a226bb9", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9c465e5a-5ecd-5fe4-b7b3-25a6a5db83b6", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d2e76de4-aa7b-51d5-bc50-5973fd289282", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7455f2d5-a42f-523b-a6bd-a3af64ab5c93", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a57b5ecc-cce7-5df6-ad34-110f26ddcfb2", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a1f777b3-c0e7-5fa1-8e00-9de74c51a344", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--43932e38-6f7a-515a-8b3b-92e132167bf8", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--b29f4608-ddf5-559f-8251-d82aff3ee25a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--77e43727-0ce8-5e69-a35c-ef3f43524ebe", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c541cb17-8af2-5c13-afd8-bd47967c50c2", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7bdcad34-92ab-522f-bac9-4bbd05c4b7a9", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--4eafa702-68b7-5c96-b175-c94d6a3b9819" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f70e6564-e693-545f-b21d-3fa5a9215e23", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--70c840b7-4380-53bb-9aa3-2315951bbea9", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1d590673-edbe-5300-89a2-4f22924f4095", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--41888906-2283-5bba-9d0d-fb742044633c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cfcb1c2a-7a18-5f73-9b05-14487061bad0", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--76a0834e-5ada-528e-9a08-8c77779141b8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0a16973c-5d43-58fb-bff4-afb0bdac0400", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--a61ebb75-2aaf-5138-8cf9-ae1fc98d45b4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a00c283f-f7c1-57e1-a1b4-24ef2555cf0c", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--3b5e4c98-f975-5f47-916c-50f9d031ea91" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bfb3bcdd-a709-5db6-a40a-6d42ae216dd4", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--14a5d446-458a-518e-99fb-750a7b6a7c10" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8a43bc7b-85c8-509a-b431-69889c9aa6e4", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--c1489edc-3848-5126-81f8-8427d852d399" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0b7e2f00-d7b4-5ad9-ac62-aed826653160", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e0a43dc4-1636-567b-926b-834d85448ded", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--aeb528d5-cd67-5306-b9ed-b9781c7fba72", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--506b2f42-8b76-5a58-a3fd-750d2938f77c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--187fb3fc-9fd7-52b9-8662-67416e2c68aa", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2072f1c9-0aa3-5af4-b7aa-1d351636b3b1", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--0ea06ae8-2525-59ab-a4b6-1f38988ecd7b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fe7dd81d-e1f4-5ad0-bf9b-d2edc278f3ea", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6e859cca-f8ed-58bb-82c6-3fd4ada64072", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--2b745188-a9c2-550d-894c-640e27442269" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fc8b7ca9-0198-55cd-8f17-77fffd14e9ed", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--dc23ed3b-430a-524c-80c0-c7f222ddbd86" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3990d8cf-dda7-55ba-bf73-839be4c28cd6", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--e126c5d3-7ff9-570d-9c87-a4839a56260a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2c45deb4-457d-5483-9bf7-484d17756483", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--cd473987-d7fd-5dba-aff5-76f723a16f9b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--54adddb6-88b5-5fb2-93a4-eebdd2e1bb11", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--a6b8ad39-bc76-5de8-b0c2-f01ed70e1401" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--57ca5aa2-e2f2-57e9-91d1-f22f5c0053a1", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "attack-pattern--626357a9-8190-520e-9388-5dc450bc8706" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--babc28b1-0ed3-5dbd-805a-8e2c06f1ba2b", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--e7d445da-5f50-5e9f-8342-1888dfd49db5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--825d72fe-901f-5f0e-9e55-ee2d756fc760", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--63f71b42-0a77-56af-85a8-3966cc8230a3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d6087bbf-9a93-5873-abc9-4b41c3c126fa", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--259a7b31-5991-5561-add0-adf6dffb4155" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2d9bd916-aeaf-58c4-bcd2-6275dad7f924", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--7aefa95f-923f-593f-8402-bd9a491e0ff5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e231c85e-818d-556b-929e-32b5eb161c71", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--be656865-8ffb-582c-a06a-c14d2fc9b7f6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ba00b45f-b14e-52a9-8101-b9ead72f80b5", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--753b32e1-97d5-505d-8a68-8e029c1717aa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--71ef7108-6217-5a4c-940e-46af5e28fcac", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--598af714-26f3-582a-a38f-9a2a49ca8ece" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2c637ff4-bf39-552b-8f7b-ea6d803f15b5", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--b9fa38de-6e7f-5cf2-b0ba-b4dec7452ca4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bec94550-bbc0-51c0-8eb3-e88b83fa5715", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--7d92c385-ee18-576e-8cb1-6d3ab402d72c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9173cbcb-f85e-5118-8f94-fb7ecd1a79df", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--65c5440d-2e57-5de6-b8c4-d9d4fb9cc9ed" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d0cd28c7-a753-599f-bdfb-a9cf4758c7e4", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--f36919cc-b39f-5536-b19d-abd37b3d77c8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4b7108c5-ae5e-5c19-8a88-1348fff6c8ba", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--5cf259eb-27a6-5902-9633-cea1eeafe3ac" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7916fe32-3942-5be9-85ee-a3451c926135", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--69f3500c-27e2-5a9d-aaf8-f9660057c5cb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--12774cba-9b5f-5320-9880-4f3e3e32a58b", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--9b890574-b444-5cab-adb7-03ff3aa189b0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ca01c711-7369-5cb4-9499-9c7d6bd338c1", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--bd2dc00e-aae8-584b-96bb-abda46316c64" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--12c5e85a-e588-5350-884a-82901a872977", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--43482d3b-ba92-5155-8afd-fa9ade6e41f0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bc99659c-3e58-5d1f-8835-0ed71c8b2aaf", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--5d211ae7-9388-5b3b-8046-277289a8878d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--72618636-3f32-58c5-9893-76e6e43d4d2b", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--4f185ad3-80b0-5f30-8d3d-0f33fd124266" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1bbf730f-193d-54b2-a751-2e4fa71af105", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--22f8042e-5054-5014-9b61-d6119c95cd71" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fe6b140f-ef23-599c-abff-b0457a2c5923", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--5a71efb4-3029-5a14-8104-994c4f3c2337" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--13d8d7d2-35cb-59ee-86da-521585c4f756", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--504fd0ec-e975-5e09-8e56-17db9aa0764b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a1a78fdc-308d-500b-892f-27e520a842a9", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--41ed084e-9975-567f-9473-a89aac19dc8e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e27d42bc-ae12-573f-a1cb-a00316acff74", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--4bb03019-1038-5daa-a834-5a576b205877" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--354070ae-33b7-56cd-83dc-38b436e9d184", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--21bdec3a-e699-5215-b7d5-cf788b5b1351" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ed867ff0-15c5-5dae-b414-86e921466549", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e32f3560-f7b3-5538-bffc-12881e8d5c88", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--09c3dc33-61d5-5ac7-a336-868b0ef4a8dc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--11d6cb60-e85c-5f16-8a6e-507c1c828d99", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--f7510cb4-a7c0-5789-a181-b17688f05538" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2f4f9069-26d2-5718-8e05-8f6db1d31491", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--70894dbb-4486-5a14-9fb1-581c44030383" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--07ce0658-aa44-5298-ac42-88c2578790a4", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--b760c810-c217-575b-96cc-6def94dc4594" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0ff8e514-d5d1-5c4a-9bce-2c6c027ce530", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--01f078ea-f375-5e7e-8d3f-e0faaf8bf4a2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fd2fd862-4c23-5517-8c0a-f2c7dbfdcb21", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--e046d243-2008-55d6-96aa-e2da13cc5234" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3fbf57d6-8353-55c8-a95a-d37a44e4af6b", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--38d1e202-1b8f-5d37-8550-dbb06c3e2969" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--66f251e3-cb88-5813-86b7-f0381fa153e4", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--ab05764c-4a9d-5fb5-b8d2-8b46b4dfbc3d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--999fe0af-f8b6-5ac1-9e6e-2476076737ae", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "malware--a84897c7-29a3-57ef-b208-e41ee1d908b0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--10543db5-82f9-5e35-9f11-40c1f0431342", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--68911d04-978f-5b9b-b76f-299cccd73510" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0bc0ae11-8305-586d-b2ac-d2c98570dc9e", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5443bd4e-f83a-51b9-83f7-cd9d979d93c1", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--59e6851b-ee01-5203-8bbe-914a99bad74f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dafbce0e-1cf2-58d6-84b2-726a5bb238b7", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--b044b2da-26b8-547a-9b3f-35b763fce3ab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fb3a89e2-1910-58e1-89e9-7651073ecabf", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--da2f4104-5d0a-5ed6-9c8d-b0dccab81a51", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--15112c05-d113-5ad8-94da-02cf9e25d7ba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3f4fb460-a344-56a4-9eee-1000c5aa7e8d", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--c91e1e52-6ba3-5f66-bfd5-71375533ed55" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e7eaf826-806f-5bdb-b803-b89b8b29498d", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--edfb2a06-46dc-56dc-a2fb-c94c218f66f8", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--08446044-528b-5072-88a8-a1f40d2a61fd", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--3d48199b-75b1-51d4-8931-542698067cae" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ab8d1478-bb8d-5932-bcc2-4b0fdf2008bf", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f33788a9-977a-5271-9df1-b57b9132ff70", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--98f4a388-d099-5d4a-844c-f8fe9a04b600", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--eff8ece2-3bf0-5ebd-b52f-70b1c1eeec75", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--389782c3-4ac3-564c-8457-11e701a68b37", "relationship_type": "uses", "source_ref": "intrusion-set--fea587f6-2e36-58df-84bc-7ca4d3e5a50a", "target_ref": "tool--387ec776-926f-532f-bde6-2a3515615fc7" } ] }