{ "type": "bundle", "id": "bundle--7ab371cb-01ab-551d-884e-95d42688b95e", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "name": "APT3", "aliases": [ "APT3", "GOTHIC PANDA", "TG-0110", "Group 6", "UPS", "Buckeye", "Boyusec", "BORON", "BRONZE MAYFAIR", "Red Sylvan", "Brocade Typhoon", "Pirpi", "UPS Team", "Threat Group-0110" ], "description": "Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets. However, Buckeyes focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.'", "resource_level": "government", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0022", "url": "https://attack.mitre.org/groups/G0022/" }, { "source_name": "skopnix", "external_id": "apt3", "url": "https://skopnix.com/actors/apt3" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html" }, { "source_name": "web.archive.org", "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong" }, { "source_name": "cfr.org", "url": "https://www.cfr.org/interactive/cyber-operations/apt-3" }, { "source_name": "secureworks.com", "url": "https://www.secureworks.com/research/threat-profiles/bronze-mayfair" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/insights/apt-groups" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0022" }, { "source_name": "recordedfuture.com", "url": "https://www.recordedfuture.com/research/chinese-mss-behind-apt3" }, { "source_name": "pwc.blogs.com", "url": "http://pwc.blogs.com/cyber_security_updates/2015/07/pirpi-scanbox.html" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801", "name": "Spearphishing Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.002", "url": "https://attack.mitre.org/techniques/T1566/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d", "name": "Exploitation for Client Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1203", "url": "https://attack.mitre.org/techniques/T1203/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54", "name": "Malicious Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.001", "url": "https://attack.mitre.org/techniques/T1204/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94", "name": "Additional Local or Domain Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.007", "url": "https://attack.mitre.org/techniques/T1098/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.001", "url": "https://attack.mitre.org/techniques/T1136/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.003", "url": "https://attack.mitre.org/techniques/T1543/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--429368be-87a1-5cbc-9896-b5c63e303f8d", "name": "Accessibility Features", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1546.008", "url": "https://attack.mitre.org/techniques/T1546/008/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e", "name": "Software Packing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.002", "url": "https://attack.mitre.org/techniques/T1027/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2c558883-337c-5465-9341-b2ff3d98faf4", "name": "Indicator Removal from Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.005", "url": "https://attack.mitre.org/techniques/T1027/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4a4d6013-7e1b-5685-9830-1bcfd9bd4155", "name": "Masquerade Account Name", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.010", "url": "https://attack.mitre.org/techniques/T1036/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a", "name": "Rundll32", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1218.011", "url": "https://attack.mitre.org/techniques/T1218/011/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393", "name": "Hidden Window", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1564.003", "url": "https://attack.mitre.org/techniques/T1564/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5", "name": "DLL", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1574.001", "url": "https://attack.mitre.org/techniques/T1574/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc", "name": "LSASS Memory", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.001", "url": "https://attack.mitre.org/techniques/T1003/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711", "name": "Password Cracking", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.002", "url": "https://attack.mitre.org/techniques/T1110/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b", "name": "Credentials In Files", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290", "name": "Credentials from Web Browsers", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555.003", "url": "https://attack.mitre.org/techniques/T1555/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1033", "url": "https://attack.mitre.org/techniques/T1033/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5", "name": "System Network Connections Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1049", "url": "https://attack.mitre.org/techniques/T1049/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--303e5d56-a0c5-587b-b5d5-f2f254b05e76", "name": "Permission Groups Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069", "url": "https://attack.mitre.org/techniques/T1069/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.001", "url": "https://attack.mitre.org/techniques/T1087/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590", "name": "Keylogging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1056.001", "url": "https://attack.mitre.org/techniques/T1056/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9", "name": "Local Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.001", "url": "https://attack.mitre.org/techniques/T1074/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9", "name": "Archive via Utility", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.001", "url": "https://attack.mitre.org/techniques/T1560/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--506b2f42-8b76-5a58-a3fd-750d2938f77c", "name": "External Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.002", "url": "https://attack.mitre.org/techniques/T1090/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403", "name": "Non-Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1095", "url": "https://attack.mitre.org/techniques/T1095/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4ee4de50-c177-565e-aa67-23c703fd9498", "name": "Multi-Stage Channels", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1104", "url": "https://attack.mitre.org/techniques/T1104/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--d549be4c-299c-5e95-8642-e66a3b74400f", "name": "OSInfo", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0165", "url": "https://attack.mitre.org/software/S0165/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d", "name": "PlugX", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0013", "url": "https://attack.mitre.org/software/S0013/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--7f26ba91-229a-5112-bfdf-84a2f63a24f0", "name": "SHOTPUT", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0063", "url": "https://attack.mitre.org/software/S0063/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--eb724f88-17aa-5d9f-a3c2-8a940ce7337f", "name": "RemoteCMD", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0166", "url": "https://attack.mitre.org/software/S0166/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--5bdfa812-c829-51dc-ae09-e82d42daac8a", "name": "schtasks", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0111", "url": "https://attack.mitre.org/software/S0111/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e69a0061-400a-5eaa-8420-b8f0c5f6bb00", "name": "LaZagne", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0349", "url": "https://attack.mitre.org/software/S0349/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cc53cda4-568a-5c10-9277-ebe32b3d8c08", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c0ed65da-dc15-5f41-bf27-bf7261b9f18c", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4c68be4b-d053-54f2-80d0-17e19910ba35", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7d3cbb5a-8a8d-5e3c-915c-a291c4383948", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c8f27b09-030c-5a52-9342-0ecbbd0ee051", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--37cba28f-f21e-5711-a6e9-d57c70b122c6", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--01828f8b-6bf7-59e1-949b-35fe48001bf5", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fedd7902-05ea-5b5f-848b-3130426015ad", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9f3e2383-ae40-57c4-ba30-ad965f8ac0e7", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6891b8a2-eee5-5567-b95f-f000c5d112e8", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fffa5222-b554-552e-9dc6-6cf22bbfc618", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--429368be-87a1-5cbc-9896-b5c63e303f8d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b115efe6-e937-5c36-8d34-bfa082e495ec", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7b83c301-f795-5ec8-a546-7965c227ed7c", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9b15c0ab-8a0b-527e-ab91-75fd86b021f9", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--2c558883-337c-5465-9341-b2ff3d98faf4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9e0d6827-b3bc-5bd1-9838-4ba3a5f1e3e6", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--4a4d6013-7e1b-5685-9830-1bcfd9bd4155" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--59a12e28-f2bf-5a27-8c27-397da5644682", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3060f09b-3f0c-5c4b-bd76-2f6c006c61cf", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9070e574-b483-5657-a89d-7ac9d07bb6ef", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0ede83b3-72b0-539e-a0f4-0f75cb86d81c", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--021e2312-2a20-5b55-8322-8d891b4f3dff", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0eddc955-685c-516b-82d5-92cac20d0a30", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7c6b51fa-30d8-5d32-8ec2-5619caedc946", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c118d903-a456-5631-946b-2ef3752f5a00", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--48ba8257-cf03-55c4-bb6f-3e4f6b7a6466", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e2cc8aa1-7aed-596d-8220-29bd0a4331bf", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fa46c1ab-b56f-5252-a44a-921abfbc7f71", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--84f5bc2c-96da-5897-a137-263cf0863c5f", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4b639067-de0d-552f-bc7f-269e15301e3e", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c353bd63-47f3-5d7d-b572-cb4fd775ed90", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--22a32b45-87e5-5b70-b87e-dc44540028b3", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--303e5d56-a0c5-587b-b5d5-f2f254b05e76" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ed362b40-3e62-51de-96eb-615d3de3060b", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f7cc9839-eb1e-5ea6-ad6e-270d523f0d9a", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--47bc7417-8fb4-5bbb-b328-6ece663bcef4", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d041fabb-efb5-55b9-b98b-dcdfeb2bf1c2", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6a05ab67-6b69-53be-aa89-8fbd43772578", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3bf5af4d-6cd2-5b56-93da-2c5f8cd04eb8", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--78032c4c-3223-5cdf-b4c4-3e38ec721987", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--213239eb-bff7-5d68-b9aa-49e87fc601fd", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--81590988-1594-5a16-b0a2-a7fae2320318", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0fdf237f-c87e-5c1c-a7ad-627a5f19578b", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--506b2f42-8b76-5a58-a3fd-750d2938f77c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b72a597b-c543-546f-86a8-dbf5c24937ee", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--13eb0ced-35f6-5f37-8e74-19e0e77f5fd7", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--4ee4de50-c177-565e-aa67-23c703fd9498" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--89972b20-f187-5c71-98cc-6ffe247d924d", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--af883b65-ed32-5da4-bc9d-f9afc3d97189", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3d701eab-f444-5c61-83df-096ffdc998cf", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "malware--d549be4c-299c-5e95-8642-e66a3b74400f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--60f82305-7faa-5594-97d4-d0564f35232f", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--509c10ff-4adf-5838-8a21-ee8d7876a079", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "malware--7f26ba91-229a-5112-bfdf-84a2f63a24f0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--207896f4-8cae-51ed-8e77-ca6cde9cd3f5", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "malware--eb724f88-17aa-5d9f-a3c2-8a940ce7337f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--982314b6-6013-55f4-a9c1-f0c1bb151edf", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "tool--5bdfa812-c829-51dc-ae09-e82d42daac8a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--91640644-39b6-5c7b-b915-ff86c284e432", "relationship_type": "uses", "source_ref": "intrusion-set--1065c61f-b030-5feb-a8ee-e59e50a3f848", "target_ref": "tool--e69a0061-400a-5eaa-8420-b8f0c5f6bb00" } ] }