{
  "type": "bundle",
  "id": "bundle--90582184-9128-5c9c-8eca-a32f757085d5",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "name": "APT31",
      "aliases": [
        "APT31",
        "ZIRCONIUM",
        "JUDGMENT PANDA",
        "BRONZE VINEWOOD",
        "Red keres",
        "Violet Typhoon",
        "TA412",
        "TIDE CASTLE"
      ],
      "description": "FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0128",
          "url": "https://attack.mitre.org/groups/G0128/"
        },
        {
          "source_name": "skopnix",
          "external_id": "apt31",
          "url": "https://skopnix.com/actors/apt31"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/"
        },
        {
          "source_name": "duo.com",
          "url": "https://duo.com/decipher/apt-groups-moving-down-the-supply-chain"
        },
        {
          "source_name": "go.recordedfuture.com",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf"
        },
        {
          "source_name": "redalert.nshc.net",
          "url": "https://redalert.nshc.net/2019/12/03/threat-actor-targeting-hong-kong-activists"
        },
        {
          "source_name": "twitter.com",
          "url": "https://twitter.com/bkMSFT/status/1201876664667582466"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/bronz-vinewood-uses-hanaloader-to-target-government-supply-chain"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/bronze-vinewood-targets-supply-chains"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/bronze-vinewood"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        },
        {
          "source_name": "research.checkpoint.com",
          "url": "https://research.checkpoint.com/2021/the-story-of-jian"
        },
        {
          "source_name": "supo.fi",
          "url": "https://supo.fi/-/suojelupoliisi-tunnisti-eduskuntaan-kohdistuneen-kybervakoiluoperaation-apt31-ksi"
        },
        {
          "source_name": "poliisi.fi",
          "url": "https://poliisi.fi/-/eduskunnan-tietojarjestelmiin-kohdistuneen-tietomurron-tutkinnassa-selvitetaan-yhteytta-apt31-toimijaan"
        },
        {
          "source_name": "pst.no",
          "url": "https://pst.no/alle-artikler/pressemeldinger/etterforskningen-av-datanettverksoperasjonen-mot-fylkesmannsembetene-er-avsluttet"
        },
        {
          "source_name": "nrk.no",
          "url": "https://www.nrk.no/norge/pst_-har-etterretning-om-at-kinesisk-gruppe-stod-bak-dataangrep-mot-statsforvaltere-1.15540601"
        },
        {
          "source_name": "ncsc.gov.uk",
          "url": "https://www.ncsc.gov.uk/news/uk-allies-hold-chinese-state-responsible-for-pervasive-pattern-of-hacking"
        },
        {
          "source_name": "gov.uk",
          "url": "https://www.gov.uk/government/news/uk-and-allies-hold-chinese-state-responsible-for-a-pervasive-pattern-of-hacking"
        },
        {
          "source_name": "foreignminister.gov.au",
          "url": "https://www.foreignminister.gov.au/minister/marise-payne/media-release/australia-joins-international-partners-attribution-malicious-cyber-activity-china"
        },
        {
          "source_name": "consilium.europa.eu",
          "url": "https://www.consilium.europa.eu/en/press/press-releases/2021/07/19/declaration-by-the-high-representative-on-behalf-of-the-eu-urging-china-to-take-action-against-malicious-cyber-activities-undertaken-from-its-territory/"
        },
        {
          "source_name": "cert.ssi.gouv.fr",
          "url": "https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003"
        },
        {
          "source_name": "twitter.com",
          "url": "https://twitter.com/bkMSFT/status/1417823714922610689"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/insights/apt-groups"
        },
        {
          "source_name": "pwc.com",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf"
        },
        {
          "source_name": "query.prod.cms.rt.microsoft.com",
          "url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi"
        },
        {
          "source_name": "pwc.co.uk",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
        },
        {
          "source_name": "proofpoint.com",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists"
        },
        {
          "source_name": "fortinet.com",
          "url": "https://www.fortinet.com/blog/psirt-blogs/importance-of-patching-an-analysis-of-the-exploitation-of-n-day-vulnerabilities"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/11/article-1-whats-cracking-at-the-kerui-cracking-academy"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/12/the-illustrious-graduates-of-wuhan-kerui"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/13/all-roads-lead-back-to-wuhan-xiaoruizhi-science-and-technology-company"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/15/trouble-in-paradise"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/16/introducing-cheng-feng"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/05/17/missing-links"
        },
        {
          "source_name": "ics-cert.kaspersky.com",
          "url": "https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Common-TTPs-of-attacks-against-industrial-organizations-implants-for-remote-access-En.pdf"
        },
        {
          "source_name": "asec.ahnlab.com",
          "url": "https://asec.ahnlab.com/ko/55070"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/07/04/wuhan-xiaoruizhi-class-of-19"
        },
        {
          "source_name": "intrusiontruth.wordpress.com",
          "url": "https://intrusiontruth.wordpress.com/2023/07/07/one-man-and-his-lasers"
        },
        {
          "source_name": "verfassungsschutz.de",
          "url": "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2023-02-bfv-cyber-brief.pdf?__blob=publicationFile&v=6"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/pr/seven-hackers-associated-chinese-government-charged-computer-intrusions-targeting-perceived"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/media/1345141/dl?inline"
        },
        {
          "source_name": "gov.uk",
          "url": "https://www.gov.uk/government/news/uk-holds-china-state-affiliated-organisations-and-individuals-responsible-for-malicious-cyber-activity"
        },
        {
          "source_name": "harfanglab.io",
          "url": "https://harfanglab.io/en/insidethelab/apt31-indictment-analysis/"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0128"
        },
        {
          "source_name": "blogs.microsoft.com",
          "url": "https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"
        },
        {
          "source_name": "research.checkpoint.com",
          "url": "https://research.checkpoint.com/2021/the-story-of-jian/"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31",
      "name": "Phishing for Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598",
          "url": "https://attack.mitre.org/techniques/T1598/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598.003",
          "url": "https://attack.mitre.org/techniques/T1598/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.001",
          "url": "https://attack.mitre.org/techniques/T1583/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74",
      "name": "Web Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.006",
          "url": "https://attack.mitre.org/techniques/T1583/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dd70352e-03c1-5a45-99b2-c1e0717d4856",
      "name": "Network Devices",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584.008",
          "url": "https://attack.mitre.org/techniques/T1584/008/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.002",
          "url": "https://attack.mitre.org/techniques/T1566/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba",
      "name": "Python",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.006",
          "url": "https://attack.mitre.org/techniques/T1059/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54",
      "name": "Malicious Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.001",
          "url": "https://attack.mitre.org/techniques/T1204/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c",
      "name": "Exploitation for Privilege Escalation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e",
      "name": "Software Packing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.002",
          "url": "https://attack.mitre.org/techniques/T1027/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c5af0804-83ea-5201-880d-10d5d2d60bb7",
      "name": "Masquerading",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036",
          "url": "https://attack.mitre.org/techniques/T1036/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48",
      "name": "Masquerade Task or Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.004",
          "url": "https://attack.mitre.org/techniques/T1036/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4",
      "name": "Deobfuscate/Decode Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3f99ef52-60b2-5ac0-9269-79caa4bd24db",
      "name": "Msiexec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.007",
          "url": "https://attack.mitre.org/techniques/T1218/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290",
      "name": "Credentials from Web Browsers",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.003",
          "url": "https://attack.mitre.org/techniques/T1555/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf",
      "name": "Query Registry",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1012",
          "url": "https://attack.mitre.org/techniques/T1012/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49",
      "name": "System Time Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1124",
          "url": "https://attack.mitre.org/techniques/T1124/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246",
      "name": "Multi-hop Proxy",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090.003",
          "url": "https://attack.mitre.org/techniques/T1090/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e",
      "name": "Bidirectional Communication",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102.002",
          "url": "https://attack.mitre.org/techniques/T1102/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72",
      "name": "Symmetric Cryptography",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.001",
          "url": "https://attack.mitre.org/techniques/T1573/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e126c5d3-7ff9-570d-9c87-a4839a56260a",
      "name": "Hide Infrastructure",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1665",
          "url": "https://attack.mitre.org/techniques/T1665/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601",
      "name": "Exfiltration Over C2 Channel",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1041",
          "url": "https://attack.mitre.org/techniques/T1041/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374",
      "name": "Exfiltration to Cloud Storage",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567.002",
          "url": "https://attack.mitre.org/techniques/T1567/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1276647d-18b6-5b0d-a033-ee2cbaadce6d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fb4e54a0-5508-5d88-b91e-6230ce396c80",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4feb7cb1-4c2f-540a-8a3d-84ffdf6ee7ae",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d53fe239-a608-5bdc-911a-82271ceb3a6f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ef9baa1f-175e-522e-94a6-53d2b2ec223b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--dd70352e-03c1-5a45-99b2-c1e0717d4856"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ad206681-edaf-5f35-9ffd-3f8ed932a82f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--09c69883-fa38-537b-a896-e66c3e4a7edc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f4ab299b-4222-5f1b-9bf7-e4b435ffdd74",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b56e41c2-6464-59c2-b241-b8d35bb29be4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f43726d8-17a6-5311-a2a1-e736e6d26ee1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--090462af-e8d6-5630-8be2-d36251fbf457",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--60c968f7-0a54-5279-9da1-6f09acbd8f23",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--71c0482e-8803-55b9-a3d6-ea08c3e663f0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--c5af0804-83ea-5201-880d-10d5d2d60bb7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc1b0da4-9240-5b6b-be6a-b15271b6a95e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2d34efff-3054-538f-8d04-8886e707ac0f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0273ec10-f090-522b-87eb-a6debbc07753",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--3f99ef52-60b2-5ac0-9269-79caa4bd24db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--318c829b-83ab-5f2e-850f-6fbc286dfae8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b00c4221-2ab5-5924-9b2b-6c70eb163283",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1c91e652-4626-51ca-b3d2-400968ff5361",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6066bfe3-9c3d-56ad-a190-c355d49f123f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--390cb01a-6111-5a13-9b28-33852efef9e6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e8bff268-df4a-5611-b5d3-11cf02c1d50f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e422eac7-1d2e-538c-9fe4-14b62344bdce",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--024b2c0c-a8e0-539e-8604-e287a3fb42db",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a53c6989-710e-5415-89b8-4189c5ea71d2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e50c8f4c-5c1f-5803-8650-a638d9ee5366",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9354416f-9b50-5990-97eb-8e54faeaf706",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--e126c5d3-7ff9-570d-9c87-a4839a56260a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6b7f0eef-ebf1-5e2d-bf36-e7915727fd7c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6f7ebe0f-96de-5b93-b58a-2951f2da9173",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--68798967-0775-5c6d-9878-4f9931471af3",
      "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374"
    }
  ]
}