{ "type": "bundle", "id": "bundle--cacfc0bd-24ce-571e-9bf3-1c123c338a93", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "name": "blackbyte", "aliases": [ "blackbyte", "Hecamede" ], "description": "Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1043", "url": "https://attack.mitre.org/groups/G1043/" }, { "source_name": "skopnix", "external_id": "blackbyte", "url": "https://skopnix.com/actors/blackbyte" }, { "source_name": "ransomware.live", "url": "https://www.ransomware.live/" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1043" }, { "source_name": "picussecurity.com", "url": "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure" }, { "source_name": "blog.talosintelligence.com", "url": "https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/" }, { "source_name": "microsoft.com", "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/" }, { "source_name": "security.com", "url": "https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware" }, { "source_name": "ic3.gov", "url": "https://www.ic3.gov/CSA/2022/220211.pdf" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "name": "Virtual Private Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.003", "url": "https://attack.mitre.org/techniques/T1583/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531", "name": "Upload Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.001", "url": "https://attack.mitre.org/techniques/T1608/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1569.002", "url": "https://attack.mitre.org/techniques/T1569/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.002", "url": "https://attack.mitre.org/techniques/T1136/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.003", "url": "https://attack.mitre.org/techniques/T1505/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.003", "url": "https://attack.mitre.org/techniques/T1543/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e5158b7b-3aeb-591e-90bb-6978273de408", "name": "Masquerade File Type", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.008", "url": "https://attack.mitre.org/techniques/T1036/008/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a", "name": "Process Injection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1055", "url": "https://attack.mitre.org/techniques/T1055/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825", "name": "Process Hollowing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1055.012", "url": "https://attack.mitre.org/techniques/T1055/012/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a94b7947-d235-5ad5-95cb-5b9b7506a0e5", "name": "Make and Impersonate Token", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1134.003", "url": "https://attack.mitre.org/techniques/T1134/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4", "name": "Deobfuscate/Decode Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1140", "url": "https://attack.mitre.org/techniques/T1140/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9bd33ccc-fad0-590b-b8f1-d47d1e009365", "name": "Execution Guardrails", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1480", "url": "https://attack.mitre.org/techniques/T1480/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--17c51644-98db-557f-bf01-22234d1aba61", "name": "OS Credential Dumping", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003", "url": "https://attack.mitre.org/techniques/T1003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf", "name": "Query Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1012", "url": "https://attack.mitre.org/techniques/T1012/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1046", "url": "https://attack.mitre.org/techniques/T1046/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044", "name": "Network Share Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1135", "url": "https://attack.mitre.org/techniques/T1135/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2ed887-dbd4-5a86-bca8-5cd2fee528ea", "name": "Domain Trust Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1482", "url": "https://attack.mitre.org/techniques/T1482/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526", "name": "Security Software Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1518.001", "url": "https://attack.mitre.org/techniques/T1518/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2682aa8e-8984-5b16-9650-036bac89f65c", "name": "System Language Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1614.001", "url": "https://attack.mitre.org/techniques/T1614/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03", "name": "Lateral Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1570", "url": "https://attack.mitre.org/techniques/T1570/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e", "name": "Archive Collected Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560", "url": "https://attack.mitre.org/techniques/T1560/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541", "name": "Remote Access Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1219", "url": "https://attack.mitre.org/techniques/T1219/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364", "name": "Exfiltration Over Web Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567", "url": "https://attack.mitre.org/techniques/T1567/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3", "name": "Modify Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1112", "url": "https://attack.mitre.org/techniques/T1112/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685", "url": "https://attack.mitre.org/techniques/T1685/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57", "name": "Disable or Modify System Firewall", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1686", "url": "https://attack.mitre.org/techniques/T1686/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83", "name": "Data Encrypted for Impact", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66", "name": "Inhibit System Recovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--926d5c4e-1ce3-5ae9-bb87-506daaca1bb8", "name": "Internal Defacement", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1491.001", "url": "https://attack.mitre.org/techniques/T1491/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--606cf482-1ec7-5272-9860-fbeb1da10dfa", "name": "BlackByte Ransomware", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1180", "url": "https://attack.mitre.org/software/S1180/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--7c821b2f-d210-5b73-b0ce-c1e883b9a63b", "name": "Exbyte", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1179", "url": "https://attack.mitre.org/software/S1179/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--242fff02-cbf8-5dd6-9620-57f73f9e2a34", "name": "BlackByte 2.0 Ransomware", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1181", "url": "https://attack.mitre.org/software/S1181/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6", "name": "Cobalt Strike", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0154", "url": "https://attack.mitre.org/software/S0154/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d", "name": "AdFind", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0552", "url": "https://attack.mitre.org/software/S0552/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--29be7f44-d302-5883-b81c-161b5092c3a8", "name": "Arp", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0099", "url": "https://attack.mitre.org/software/S0099/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4a9bac63-f32f-5154-9924-372367b49c05", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--83b09522-a4bd-5861-bd32-0aab22ae4060", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f6fb741b-17b8-5adf-9cfb-8155f3dced0c", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--82c2dd82-a968-5a66-bb39-b003c49fab3c", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--68c84ef6-50b0-548b-86cc-935988a81af1", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1554a82a-3438-5d01-b280-cb1ab9752be6", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--30aaff67-4e65-58d2-8ce5-6583ee57095a", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--289a51d5-8481-5ec0-9925-49fe28d4f084", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--63cb8325-7998-5177-bffa-df377e185d6d", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e9837697-9cc7-56c9-adb4-516fb2dc9001", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d1c0176f-ba50-51f3-a67f-c529418da752", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--435194ca-c699-556c-8371-9b10ccb7eb17", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e4c2caf4-d7f9-50bd-a9ed-2c69c3807280", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3fbcefdb-658d-5686-b4ac-e888044fcb79", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--e5158b7b-3aeb-591e-90bb-6978273de408" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--401cfd59-9be2-5a3f-b0fc-5608e56b7953", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3c760b97-8fcb-5cdf-8808-7f143b01a650", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--754a130a-2393-553b-a6b8-dccd220a4268", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6ae51b03-53fa-5fec-9593-644225f8216d", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--25b5996a-ea99-58ea-9558-e665e800df51", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f4c44cb5-babe-5753-9ab9-776c0c7205a3", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--a94b7947-d235-5ad5-95cb-5b9b7506a0e5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8fba9c6a-eebe-5b3b-a388-e04ba07694b4", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--648d1f68-4b29-5730-b26c-a1cefe9c0fc9", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--9bd33ccc-fad0-590b-b8f1-d47d1e009365" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9986ab0d-7697-593e-aa5d-bc66d8af70e6", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--17c51644-98db-557f-bf01-22234d1aba61" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--58672ec9-d59a-53de-9e20-ec1a80499ae5", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ef242a97-175d-5e6b-8238-23e35ec9247e", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--59d696fa-840c-56c4-a07e-5f65aa9cab25", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d338af04-1511-5a20-a4be-4485f44fb281", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--410d9c12-5978-56d8-9555-3c86e907835f", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3125a92a-9e92-5368-9bef-d1f12b3134ed", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1a7a3dc5-a7b7-5ae2-aeb3-4804b94e8328", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--360cdb81-a536-5804-b4e5-1f7d3ebafd34", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--6b2ed887-dbd4-5a86-bca8-5cd2fee528ea" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cb328468-f86a-5293-85ac-678aa272ebca", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--122f2d59-eb71-58e8-b856-542a9e38f74e", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--2682aa8e-8984-5b16-9650-036bac89f65c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fb7afa4a-b9bb-5591-b777-1d03393b2c9e", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f4fd434f-6492-5242-a694-19e960821da7", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6b31172f-9fdd-553c-bc94-3f7d91ba75f0", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--96fdbd8c-e447-5371-88ee-1077c4982a6b", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0b5351fb-3f14-566c-9518-689828bd0c29", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--553a6917-8ed0-564e-b575-0c0a5a745198", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--176aaba8-8529-5698-879c-9a5a3a2f86e5", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3faf1202-d495-5e7a-a00b-a6ab06c0b1a6", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8147ae14-0cf3-5dfa-91d7-4d2f7bbe1b75", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--499d1cf5-9d41-5e6b-993d-636a8856658f", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fe572186-b969-5192-969e-f50404df7704", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e01ca8b7-d17f-5f14-9c2b-33ac50653ce5", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--111a7c53-a04a-56fe-8786-858a2dc9101c", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e05daf81-4a90-5f32-ba9e-6f60e9a17763", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e2ce16a2-beb8-5687-9735-57cec284f95c", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "attack-pattern--926d5c4e-1ce3-5ae9-bb87-506daaca1bb8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--20958e6c-8207-553d-b656-e1a0bb89cc4d", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "malware--606cf482-1ec7-5272-9860-fbeb1da10dfa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dec847dc-8256-5319-899e-6001a894b4ac", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "malware--7c821b2f-d210-5b73-b0ce-c1e883b9a63b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c9472348-c6d1-5071-9097-55bfab38a44b", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "malware--242fff02-cbf8-5dd6-9620-57f73f9e2a34" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0992d85e-2354-5446-9d7a-18e27f1c0de3", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--28cd8951-380b-59ce-b7b8-6c60546c0951", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9b15c5c9-9147-5d77-a4a9-5e9e55548e5c", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "tool--29be7f44-d302-5883-b81c-161b5092c3a8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6e04212e-8b21-57ec-b954-3af988a252d7", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cc80ed3b-bcbc-5692-85bd-a7bc0dd9aebb", "relationship_type": "uses", "source_ref": "intrusion-set--853a5d84-79d8-5d12-8b8a-78d1ed5ce9a1", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" } ] }