{
  "type": "bundle",
  "id": "bundle--5ed96495-7236-54d5-a5bb-e2e5a4572074",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "name": "Cobalt",
      "aliases": [
        "Cobalt",
        "Cobalt Group",
        "Cobalt Gang",
        "GOLD KINGSWOOD",
        "COBALT SPIDER",
        "Mule Libra"
      ],
      "description": "A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0080",
          "url": "https://attack.mitre.org/groups/G0080/"
        },
        {
          "source_name": "skopnix",
          "external_id": "cobalt",
          "url": "https://skopnix.com/actors/cobalt"
        },
        {
          "source_name": "helpnetsecurity.com",
          "url": "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/"
        },
        {
          "source_name": "bleepingcomputer.com",
          "url": "https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/"
        },
        {
          "source_name": "group-ib.com",
          "url": "https://www.group-ib.com/blog/cobalt"
        },
        {
          "source_name": "reuters.com",
          "url": "https://www.reuters.com/article/us-taiwan-cyber-atms/taiwan-atm-heist-linked-to-european-hacking-spree-security-firm-idUSKBN14P0CX"
        },
        {
          "source_name": "proofpoint.com",
          "url": "https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"
        },
        {
          "source_name": "blog.trendmicro.com",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"
        },
        {
          "source_name": "riskiq.com",
          "url": "https://www.riskiq.com/blog/labs/cobalt-strike/"
        },
        {
          "source_name": "riskiq.com",
          "url": "https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
        },
        {
          "source_name": "europol.europa.eu",
          "url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
        },
        {
          "source_name": "computerweekly.com",
          "url": "https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested"
        },
        {
          "source_name": "ptsecurity.com",
          "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"
        },
        {
          "source_name": "secureworks.com",
          "url": "http://www.secureworks.com/research/threat-profiles/gold-kingswood"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/atoms/mulelibra/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0080"
        },
        {
          "source_name": "crowdstrike.lookbookhq.com",
          "url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
        },
        {
          "source_name": "blog.morphisec.com",
          "url": "https://blog.morphisec.com/cobalt-gang-2.0"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734",
      "name": "Compromise Software Supply Chain",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1195.002",
          "url": "https://attack.mitre.org/techniques/T1195/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.002",
          "url": "https://attack.mitre.org/techniques/T1566/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6",
      "name": "Scheduled Task",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009",
      "name": "Visual Basic",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.005",
          "url": "https://attack.mitre.org/techniques/T1059/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c",
      "name": "JavaScript",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.007",
          "url": "https://attack.mitre.org/techniques/T1059/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d",
      "name": "Exploitation for Client Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1203",
          "url": "https://attack.mitre.org/techniques/T1203/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54",
      "name": "Malicious Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.001",
          "url": "https://attack.mitre.org/techniques/T1204/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b9d104d7-14ac-5f42-9b93-e42147be2797",
      "name": "Dynamic Data Exchange",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1559.002",
          "url": "https://attack.mitre.org/techniques/T1559/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a25693d-53be-5ca4-947d-671fb9cbab17",
      "name": "Logon Script (Windows)",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1037.001",
          "url": "https://attack.mitre.org/techniques/T1037/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c",
      "name": "Exploitation for Privilege Escalation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98",
      "name": "Bypass User Account Control",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1548.002",
          "url": "https://attack.mitre.org/techniques/T1548/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f",
      "name": "Command Obfuscation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.010",
          "url": "https://attack.mitre.org/techniques/T1027/010/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a",
      "name": "Process Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055",
          "url": "https://attack.mitre.org/techniques/T1055/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208",
      "name": "File Deletion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--04f1fc7e-555a-5037-9586-29522f535836",
      "name": "CMSTP",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.003",
          "url": "https://attack.mitre.org/techniques/T1218/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1cd907c6-3a8c-5858-b95b-cdae3690635e",
      "name": "Odbcconf",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.008",
          "url": "https://attack.mitre.org/techniques/T1218/008/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f5e830f8-8c08-50ba-9b3d-d9b0d45f4bc4",
      "name": "Regsvr32",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.010",
          "url": "https://attack.mitre.org/techniques/T1218/010/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7e2384af-7fe3-5acf-aacc-d019f09e497f",
      "name": "XSL Script Processing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1220",
          "url": "https://attack.mitre.org/techniques/T1220/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce",
      "name": "Network Service Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1046",
          "url": "https://attack.mitre.org/techniques/T1046/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526",
      "name": "Security Software Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1518.001",
          "url": "https://attack.mitre.org/techniques/T1518/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609",
      "name": "Remote Desktop Protocol",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.001",
          "url": "https://attack.mitre.org/techniques/T1021/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522",
      "name": "DNS",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.004",
          "url": "https://attack.mitre.org/techniques/T1071/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541",
      "name": "Remote Access Tools",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1219",
          "url": "https://attack.mitre.org/techniques/T1219/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b",
      "name": "Protocol Tunneling",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1572",
          "url": "https://attack.mitre.org/techniques/T1572/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed",
      "name": "Asymmetric Cryptography",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.002",
          "url": "https://attack.mitre.org/techniques/T1573/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--c86770a7-d5ea-531d-be23-8964191255d4",
      "name": "More_eggs",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0284",
          "url": "https://attack.mitre.org/software/S0284/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--375abfef-6380-5c3a-859c-88784bb6300e",
      "name": "SpicyOmelette",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0646",
          "url": "https://attack.mitre.org/software/S0646/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6",
      "name": "Cobalt Strike",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0154",
          "url": "https://attack.mitre.org/software/S0154/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--15112c05-d113-5ad8-94da-02cf9e25d7ba",
      "name": "SDelete",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0195",
          "url": "https://attack.mitre.org/software/S0195/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--797702d7-c152-543a-9bfc-b1727034f69d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c859185d-0ee0-5c89-b46a-18b9d5bc0451",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--df206ac8-800b-5181-bc2c-ad430b82ae77",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d847e24f-84da-5367-a2b3-14608b20b255",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7401514f-dbe4-5573-92be-e7c34c1f74a7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--24ae704a-3534-5122-974c-11485ddbf63b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c9e80618-103d-5b2e-9f60-9e6f3944ccf1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a5d15f44-6d87-51dd-a328-d09a07414847",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a8c74ed8-f8bc-51fe-b069-f4c6beed9b2b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--21acbf25-07ea-5b03-90f0-46b6cc21706a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--67b030fd-8e08-57a4-ba68-f4c7cb289f30",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f0177ee6-b25a-5e22-821c-69cb5c054a40",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d9bf68b3-e9bd-593b-827a-5bb54ab8657a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--b9d104d7-14ac-5f42-9b93-e42147be2797"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--755a7bc5-cf4a-5b96-b572-3e40e291c0f8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--3a25693d-53be-5ca4-947d-671fb9cbab17"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--45654af7-ebb4-54a8-a868-0ce6beea7857",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--103a2cb4-c559-5073-8116-2ff43b9885c7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6c441fec-3aad-58c2-9ba6-14e498c3bc15",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--631193a7-ff30-585b-9eb4-9737a1e4d8d9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2dc138ba-1a93-510e-b996-3c07fe4eea5f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2c4af4d5-f949-5f9f-b983-8ef072443395",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--03d65ed1-9c9a-5133-b37b-eab215ad8d17",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--96a09162-95dc-52eb-a287-2c695deb3be6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--04f1fc7e-555a-5037-9586-29522f535836"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--09df7ea7-0cf0-57d7-9424-ac66c86979f4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--1cd907c6-3a8c-5858-b95b-cdae3690635e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dd0e9e93-722d-5f46-88e2-458683ad0387",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--f5e830f8-8c08-50ba-9b3d-d9b0d45f4bc4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--480def0a-c6e1-5a6b-97b2-d57a5f460a4f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--7e2384af-7fe3-5acf-aacc-d019f09e497f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7b6fe2ad-2a1b-5d2e-8323-793ac71e341a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--369b6afa-95dc-5eb4-97a8-752380c46cd3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9180ffe6-1e77-5819-8d33-d2cf2e06ff5b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--101bb910-90a3-584c-9bd5-832ed5b5cf14",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--055a0260-d48c-56d8-9197-6dd9c4ab097d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--4b15b0b6-5eb4-5c0e-bf7a-fb2d17064522"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--14bf34f0-04bd-530c-8643-18b0d6b214b5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5b3319e2-24e3-5d48-abd4-d0ea80872d43",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cbd38cc0-1a06-5bab-9733-9f4d757539dc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e46b8098-e698-5fbd-9480-27bc507e5cd7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--23792dd4-2e11-55f9-b576-395c8b189a70",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "malware--c86770a7-d5ea-531d-be23-8964191255d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f9211009-0b3b-5a83-9b8d-06c7e0c5ad2a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "malware--375abfef-6380-5c3a-859c-88784bb6300e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ba2216eb-73a0-5279-822d-4018a45deadf",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2c5d0d86-546e-5cd4-8c2e-5c0a7a6d43f4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e16f9d5b-58c9-5d29-a902-5d26f160729f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "tool--15112c05-d113-5ad8-94da-02cf9e25d7ba"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--095aad4e-9858-58dc-b874-3367f321ce5f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--74277633-eee7-5901-8585-50087a3c1078",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    }
  ]
}