{
  "type": "bundle",
  "id": "bundle--304e008d-d5da-5f5d-b626-2da511300908",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "name": "APT41",
      "aliases": [
        "APT41",
        "TA415",
        "Blackfly",
        "Grayfly",
        "LEAD",
        "BARIUM",
        "WICKED SPIDER",
        "WICKED PANDA",
        "BRONZE ATLAS",
        "BRONZE EXPORT",
        "Red Kelpie",
        "Earth Baku",
        "Amoeba",
        "HOODOO",
        "Brass Typhoon",
        "Winnti",
        "Double Dragon",
        "TG-2633",
        "Leopard Typhoon",
        "SPIRE CASTLE"
      ],
      "description": "APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0044",
          "url": "https://attack.mitre.org/groups/G0044/"
        },
        {
          "source_name": "skopnix",
          "external_id": "apt41",
          "url": "https://skopnix.com/actors/apt41"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/winnti-faq-more-than-just-a-game/57585/"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/winnti-more-than-just-a-game/37029/"
        },
        {
          "source_name": "williamshowalter.com",
          "url": "http://williamshowalter.com/a-universal-windows-bootkit/"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/games-are-over/70991/"
        },
        {
          "source_name": "medium.com",
          "url": "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"
        },
        {
          "source_name": "dw.com",
          "url": "https://www.dw.com/en/thyssenkrupp-victim-of-cyber-attack/a-36695341"
        },
        {
          "source_name": "bleepingcomputer.com",
          "url": "https://www.bleepingcomputer.com/news/security/teamviewer-confirms-undisclosed-breach-from-2016/"
        },
        {
          "source_name": "blog.trendmicro.com",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/"
        },
        {
          "source_name": "dw.com",
          "url": "https://www.dw.com/en/bayer-points-finger-at-wicked-panda-in-cyberattack/a-48196004"
        },
        {
          "source_name": "welivesecurity.com",
          "url": "https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/"
        },
        {
          "source_name": "401trg.com",
          "url": "https://401trg.com/burning-umbrella/"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/bronze-atlas"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/bronze-export"
        },
        {
          "source_name": "pwc.co.uk",
          "url": "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer"
        },
        {
          "source_name": "assets.documentcloud.org",
          "url": "https://assets.documentcloud.org/documents/7210602/FLASH-AC-000133-TT-Published.pdf"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/cyber-operations/winnti-umbrella"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/report-apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/cyber-operations/apt-41"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0096"
        },
        {
          "source_name": "uscc.gov",
          "url": "https://www.uscc.gov/sites/default/files/2022-02/Adam_Kozy_Testimony.pdf"
        },
        {
          "source_name": "pwc.com",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf"
        },
        {
          "source_name": "pwc.co.uk",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf"
        },
        {
          "source_name": "welivesecurity.com",
          "url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"
        },
        {
          "source_name": "services.google.com",
          "url": "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        },
        {
          "source_name": "group-ib.com",
          "url": "https://www.group-ib.com/blog/colunmtk-apt41/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0044"
        },
        {
          "source_name": "symantec.com",
          "url": "http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
        },
        {
          "source_name": "401trg.github.io",
          "url": "https://401trg.github.io/pages/burning-umbrella.html"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.001",
          "url": "https://attack.mitre.org/techniques/T1583/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1934438a-00cf-5044-a56f-3193c0a0c42e",
      "name": "Rootkit",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1014",
          "url": "https://attack.mitre.org/techniques/T1014/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
      "name": "Process Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b",
      "name": "File and Directory Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1083",
          "url": "https://attack.mitre.org/techniques/T1083/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710",
      "name": "Code Signing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.002",
          "url": "https://attack.mitre.org/techniques/T1553/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--10dc4093-730f-5c5e-a71d-b33c5f48cc87",
      "name": "PipeMon",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0501",
          "url": "https://attack.mitre.org/software/S0501/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--622c7971-73c0-53ec-ab17-e5634531e100",
      "name": "Winnti for Windows",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0141",
          "url": "https://attack.mitre.org/software/S0141/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d",
      "name": "PlugX",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0013",
          "url": "https://attack.mitre.org/software/S0013/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--e04f50b0-3ab0-56d1-a8a9-f4907a3c5a9a",
      "name": "BITSAdmin",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0190",
          "url": "https://attack.mitre.org/software/S0190/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8",
      "name": "Impacket",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0357",
          "url": "https://attack.mitre.org/software/S0357/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236",
      "name": "netstat",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0104",
          "url": "https://attack.mitre.org/software/S0104/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--b0dd36a1-f1d0-5cf4-998a-e7cdd29b3501",
      "name": "PowerSploit",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0194",
          "url": "https://attack.mitre.org/software/S0194/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--1a35e4fb-befb-57ef-a774-5fe51e6e6d0b",
      "name": "Ping",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0097",
          "url": "https://attack.mitre.org/software/S0097/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d",
      "name": "Net",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0039",
          "url": "https://attack.mitre.org/software/S0039/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632",
      "name": "ipconfig",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0100",
          "url": "https://attack.mitre.org/software/S0100/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--ff39c07c-6bb3-5559-872c-0ff900260493",
      "name": "sqlmap",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0225",
          "url": "https://attack.mitre.org/software/S0225/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6",
      "name": "certutil",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0160",
          "url": "https://attack.mitre.org/software/S0160/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--21674391-d168-52b0-b478-2ba19180b32d",
      "name": "Empire",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0363",
          "url": "https://attack.mitre.org/software/S0363/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--7026cbe3-536b-558e-b08b-b950f7ff8c15",
      "name": "pwdump",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0006",
          "url": "https://attack.mitre.org/software/S0006/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--02226c4b-9bbc-5873-ab16-26e8bbd76de9",
      "name": "dsquery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0105",
          "url": "https://attack.mitre.org/software/S0105/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--8fb98fc5-bc8c-5f00-983c-1d94b5e3c70d",
      "name": "ftp",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0095",
          "url": "https://attack.mitre.org/software/S0095/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6c35b730-d31b-5538-a98c-db2a28613a9b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2aedf95e-762d-555b-a532-b0864e254641",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--1934438a-00cf-5044-a56f-3193c0a0c42e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c3e86a7f-e6e1-57c0-b09f-b3eabe6ab821",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--89b1efa3-5b4a-5f1c-9bdf-843b7215a8fc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b3166865-32fe-5a75-a5dd-d411dc879e75",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ff480550-c9bd-5bde-b870-01765108d55e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e221f5c1-0057-54f5-a48c-735ffbc31a82",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "malware--10dc4093-730f-5c5e-a71d-b33c5f48cc87"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7cdac150-a023-53b8-a085-7f17dfdb9930",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "malware--622c7971-73c0-53ec-ab17-e5634531e100"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--83929660-c098-57f5-8733-e086d16336bf",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--642ac49a-9076-5066-9987-0ce968b256f7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--e04f50b0-3ab0-56d1-a8a9-f4907a3c5a9a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3519466d-ddc7-5d6e-814f-8e35144eda48",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cab2f67a-4af5-56a1-be8d-3154766fffb5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4822acc7-e661-540e-bbd4-ca54157747e2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--b0dd36a1-f1d0-5cf4-998a-e7cdd29b3501"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--25ba03de-f50a-5d57-90fd-642b4e55e253",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--1a35e4fb-befb-57ef-a774-5fe51e6e6d0b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dd386527-4e4b-5393-a815-ab3233e2e84d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bdb59532-b5ca-5fa2-989f-8a4eff5aad45",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a227d7a8-4df6-59c7-9b7b-f3482bb4f58e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--ff39c07c-6bb3-5559-872c-0ff900260493"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a9028e69-8b5f-51c0-8161-b6682f44bdab",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e06b4b84-a8ba-5ce9-940d-3d3e3fc7fe0a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7e7843a4-0012-5b42-b62c-1cb422497717",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--21674391-d168-52b0-b478-2ba19180b32d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--638584ee-b664-56ee-9ac8-2729561b63f6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--7026cbe3-536b-558e-b08b-b950f7ff8c15"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a099536c-9973-5149-8bb0-614ce6a8aae7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--02226c4b-9bbc-5873-ab16-26e8bbd76de9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1d79bda2-d2a0-5094-bdb6-810561497884",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--5d089a98-ee6c-5d8d-91ba-0bc21d2606ac",
      "target_ref": "tool--8fb98fc5-bc8c-5f00-983c-1d94b5e3c70d"
    }
  ]
}