{ "type": "bundle", "id": "bundle--826c33ca-c376-5c04-a298-289863c42900", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "name": "Chimera", "aliases": [ "Chimera" ], "description": "Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0114", "url": "https://attack.mitre.org/groups/G0114/" }, { "source_name": "skopnix", "external_id": "chimera", "url": "https://skopnix.com/actors/chimera" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0114" }, { "source_name": "cycraft.com", "url": "https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf" }, { "source_name": "web.archive.org", "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8", "name": "Credentials", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1589.001", "url": "https://attack.mitre.org/techniques/T1589/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61", "name": "Native API", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1106", "url": "https://attack.mitre.org/techniques/T1106/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1569.002", "url": "https://attack.mitre.org/techniques/T1569/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766", "name": "External Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f", "name": "Command Obfuscation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.010", "url": "https://attack.mitre.org/techniques/T1027/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "name": "Match Legitimate Resource Name or Location", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c", "name": "Timestomp", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.006", "url": "https://attack.mitre.org/techniques/T1070/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5", "name": "DLL", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1574.001", "url": "https://attack.mitre.org/techniques/T1574/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c", "name": "NTDS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.003", "url": "https://attack.mitre.org/techniques/T1003/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "name": "Password Spraying", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.003", "url": "https://attack.mitre.org/techniques/T1110/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--66217b61-6955-51d7-95f9-59f201d67f3b", "name": "Credential Stuffing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.004", "url": "https://attack.mitre.org/techniques/T1110/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a", "name": "Multi-Factor Authentication Interception", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1111", "url": "https://attack.mitre.org/techniques/T1111/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662", "name": "System Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1007", "url": "https://attack.mitre.org/techniques/T1007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf", "name": "Query Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1012", "url": "https://attack.mitre.org/techniques/T1012/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1033", "url": "https://attack.mitre.org/techniques/T1033/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1046", "url": "https://attack.mitre.org/techniques/T1046/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5", "name": "System Network Connections Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1049", "url": "https://attack.mitre.org/techniques/T1049/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--147376fd-0c1c-54ec-8f53-4845325770aa", "name": "Local Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069.001", "url": "https://attack.mitre.org/techniques/T1069/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.001", "url": "https://attack.mitre.org/techniques/T1087/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49", "name": "System Time Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1124", "url": "https://attack.mitre.org/techniques/T1124/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044", "name": "Network Share Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1135", "url": "https://attack.mitre.org/techniques/T1135/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--014d2606-fe96-5bf7-82a3-f755be9bac0a", "name": "Password Policy Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1201", "url": "https://attack.mitre.org/techniques/T1201/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55", "name": "Browser Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1217", "url": "https://attack.mitre.org/techniques/T1217/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2ed887-dbd4-5a86-bca8-5cd2fee528ea", "name": "Domain Trust Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1482", "url": "https://attack.mitre.org/techniques/T1482/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca", "name": "Local Storage Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1680", "url": "https://attack.mitre.org/techniques/T1680/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58bce1b-5309-59a0-88cf-eae63abd819a", "name": "Windows Remote Management", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.006", "url": "https://attack.mitre.org/techniques/T1021/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159", "name": "Pass the Hash", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1550.002", "url": "https://attack.mitre.org/techniques/T1550/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03", "name": "Lateral Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1570", "url": "https://attack.mitre.org/techniques/T1570/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0d83c74-95e3-54c4-80bb-b14c0f983da7", "name": "Data from Network Shared Drive", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1039", "url": "https://attack.mitre.org/techniques/T1039/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9", "name": "Local Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.001", "url": "https://attack.mitre.org/techniques/T1074/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a", "name": "Remote Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.002", "url": "https://attack.mitre.org/techniques/T1074/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6", "name": "Local Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.001", "url": "https://attack.mitre.org/techniques/T1114/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d", "name": "Remote Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.002", "url": "https://attack.mitre.org/techniques/T1114/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab", "name": "Automated Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1119", "url": "https://attack.mitre.org/techniques/T1119/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6", "name": "Sharepoint", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.002", "url": "https://attack.mitre.org/techniques/T1213/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9", "name": "Archive via Utility", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.001", "url": "https://attack.mitre.org/techniques/T1560/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522", "name": "DNS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.004", "url": "https://attack.mitre.org/techniques/T1071/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b", "name": "Protocol Tunneling", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1572", "url": "https://attack.mitre.org/techniques/T1572/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374", "name": "Exfiltration to Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5ec3f719-f370-52a9-8c3e-4334ee08b636", "name": "Domain Controller Authentication", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1556.001", "url": "https://attack.mitre.org/techniques/T1556/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351", "name": "Clear Windows Event Logs", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685.005", "url": "https://attack.mitre.org/techniques/T1685/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6", "name": "Cobalt Strike", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0154", "url": "https://attack.mitre.org/software/S0154/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef", "name": "BloodHound", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0521", "url": "https://attack.mitre.org/software/S0521/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--cd4a3def-bbec-56b4-b135-27aba113e711", "name": "esentutl", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0404", "url": "https://attack.mitre.org/software/S0404/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d", "name": "Net", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0039", "url": "https://attack.mitre.org/software/S0039/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d0a0488a-3878-5fa6-b2ed-6714a270cc77", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--932ebc3c-fcad-5386-8733-4cf953ba6739", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e040e474-f592-5306-a509-fa6a6e5a1542", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c4d21287-8dcb-5f91-8d90-74f72143479b", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8febf918-574e-5bfd-94f0-f5e40fa49255", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--44edf2b3-964c-5e43-b46f-6011bab775e2", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1832d6df-b9d3-5813-a0a7-2a502e642d0c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8aaa4186-9a3b-548b-af89-f8434ee4aecf", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--72af7474-dcef-5161-9ace-ea83a30216a5", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a2b2b3a0-09fc-5af7-97d3-21587fba041b", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1e9c49df-82eb-5883-990a-ba8ac2752d1f", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--142f7164-235f-5773-bf44-accc2b2bf22c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--81618b0d-b9e8-5dc2-bbca-fc00964024f2", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d24bc107-8b43-5a59-9a18-f1835589331e", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--00676e22-dfc2-55ce-bb5a-1a6976c453be", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--488ce59b-8bf6-572e-a89d-c9deff5d7bca", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--881dd0e9-891f-5332-bea2-15ec28f7405c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--63446d82-c6a6-5ea6-8e8b-d73581c268c2", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3e91af3f-8fa2-523f-8874-1d1003d73f5c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--66217b61-6955-51d7-95f9-59f201d67f3b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8f62180c-9dd6-5769-965c-224331a988ca", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3a4ee96f-552e-509c-ab9d-ba8f729eb7ff", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--398f2771-7328-55cd-8766-47d45f791456", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--50197114-4e05-505e-ac02-900bb3631155", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--74c34108-6160-5a8c-a3a1-523ee39cc843", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0cdc2326-13fc-5cb9-b1d4-53edc066f1f3", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--eb6a3fe3-a783-56c6-9e19-a384541cfe3d", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a313f695-4df6-5e13-bb26-d505acc60ae4", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ca57ffaf-dd51-5d3e-84b9-179a8425e0c7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ca0128ff-b10e-5199-af3b-9e6d2f432323", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--147376fd-0c1c-54ec-8f53-4845325770aa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--52d83a0a-3643-5c2e-bf02-d4e49a7c9628", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7217ad55-204c-56c9-ac00-78ebe040350c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d0565ff5-9760-5d86-ba7a-5aaaf1eed85d", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--07d6433f-9c5f-5495-b50d-80fe9c590f42", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5aef2eea-5878-5116-ae49-a679bd3ed2e3", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e035a712-2394-5c8d-8eaf-d6fd10ee3a0d", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--014d2606-fe96-5bf7-82a3-f755be9bac0a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--33f6e33d-8cd2-5537-84cb-c039680deb11", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--18d9cf92-1c73-5e75-a1d0-07296f0de8af", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--6b2ed887-dbd4-5a86-bca8-5cd2fee528ea" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b332948b-f5d2-5179-913d-aaab232b7cf8", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0e72f5a0-90cb-53c2-b0d9-cde4c4f47efd", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--69f96d5b-7e7e-557a-b26a-c9507edf9ac3", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4bd76601-908c-5ed8-a4a5-d1463df2bef1", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--c58bce1b-5309-59a0-88cf-eae63abd819a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--22470e96-a727-5395-8919-bcb0174ac3c8", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7c774ec3-3d22-5856-9168-74d49018b7d7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fd33bdda-1e15-52f9-bf20-4194c6bc6501", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--a0d83c74-95e3-54c4-80bb-b14c0f983da7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--603f3364-1e33-530a-85cb-fb1811754882", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--84e3b210-c799-55d4-a91c-def5f9a0602e", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5858d583-a401-5667-8e8d-37546a405811", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e8f4a005-6375-5c57-8c6c-de4e91619595", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d64be1c2-4373-5028-a889-ce76fce1e265", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f09c9e44-57a5-5405-aca6-72647e5523b3", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--913d99fa-9236-5629-9e30-fad2d4a401a1", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2970eae6-1251-5d68-a219-b30c4824e2ef", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--88fb74a8-8196-5c3f-b9e9-8bd23bad8a9c", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2f8f2fee-79f1-5efa-b77d-717a271edbd7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--73e38530-1df9-51f9-a653-86491b606fc5", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--02cbab68-f255-5afc-8ca9-8b97268f8828", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--facfe81a-47e5-57b5-bca8-6cdc0b4232f7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bdfe5086-271c-572f-b684-22cf555107c9", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--5ec3f719-f370-52a9-8c3e-4334ee08b636" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d60337ef-8ebc-54e1-be33-63a766d35516", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7ac3848c-43f1-5d8a-b9d4-633cc17b4a40", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7c5811e6-81ed-577f-b16d-e8f2d7b1adc7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c20296b0-526b-5975-9cea-5ff914505493", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9e41611e-3bae-5d20-81be-40887de490c2", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "tool--cd4a3def-bbec-56b4-b135-27aba113e711" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dbf9e7e9-301d-5788-a105-bb27734e829e", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3eeac5b6-a546-5163-b8ac-373a8543c6c7", "relationship_type": "uses", "source_ref": "intrusion-set--8ca0aba7-5ace-582b-ada4-4cf6bacaa35d", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" } ] }