{ "type": "bundle", "id": "bundle--2785146a-cacf-598a-ab66-df3c048a4185", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "name": "Contagious Interview", "aliases": [ "Contagious Interview", "DeceptiveDevelopment", "Gwisin Gang", "Tenacious Pungsan", "DEV#POPPER", "PurpleBravo", "TAG-121" ], "description": "Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1052", "url": "https://attack.mitre.org/groups/G1052/" }, { "source_name": "skopnix", "external_id": "contagious-interview", "url": "https://skopnix.com/actors/contagious-interview" }, { "source_name": "about.gitlab.com", "url": "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/" }, { "source_name": "sentinelone.com", "url": "https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/" }, { "source_name": "microsoft.com", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1052" }, { "source_name": "validin.com", "url": "https://www.validin.com/blog/inoculating_contagious_interview_with_validin/" }, { "source_name": "esentire.com", "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2" }, { "source_name": "securitylabs.datadoghq.com", "url": "https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/" }, { "source_name": "recordedfuture.com", "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat" }, { "source_name": "welivesecurity.com", "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--579dca05-30ce-5de6-8f74-97cd55fe5a18", "name": "Gather Victim Identity Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1589", "url": "https://attack.mitre.org/techniques/T1589/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fc1355fb-d707-5f8e-a486-f120be2af153", "name": "Search Open Websites/Domains", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1593", "url": "https://attack.mitre.org/techniques/T1593/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807", "name": "Social Media", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1593.001", "url": "https://attack.mitre.org/techniques/T1593/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f", "name": "Code Repositories", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1593.003", "url": "https://attack.mitre.org/techniques/T1593/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b029bb82-521a-502a-af34-b0df33d9df9c", "name": "Search Threat Vendor Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1681", "url": "https://attack.mitre.org/techniques/T1681/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--baff43a1-be43-52dc-a7bc-4d0995b420d2", "name": "Acquire Infrastructure", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583", "url": "https://attack.mitre.org/techniques/T1583/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "name": "Domains", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "name": "Virtual Private Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.003", "url": "https://attack.mitre.org/techniques/T1583/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74", "name": "Web Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.006", "url": "https://attack.mitre.org/techniques/T1583/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1fe7ed47-3bc0-545a-b1c5-d5d9cfb6a801", "name": "Establish Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585", "url": "https://attack.mitre.org/techniques/T1585/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d", "name": "Social Media Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.001", "url": "https://attack.mitre.org/techniques/T1585/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98", "name": "Email Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.002", "url": "https://attack.mitre.org/techniques/T1585/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784", "name": "Develop Capabilities", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587", "url": "https://attack.mitre.org/techniques/T1587/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3", "name": "Artificial Intelligence", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.007", "url": "https://attack.mitre.org/techniques/T1588/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531", "name": "Upload Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.001", "url": "https://attack.mitre.org/techniques/T1608/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36ee37f2-9509-5038-bdfa-156962c1bb1b", "name": "Written Content", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1683.001", "url": "https://attack.mitre.org/techniques/T1683/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a51fd8ac-5b4b-598e-bd7a-3fae18063969", "name": "Audio-Visual Content", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1683.002", "url": "https://attack.mitre.org/techniques/T1683/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd", "name": "Spearphishing via Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.003", "url": "https://attack.mitre.org/techniques/T1566/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0968668b-c601-577e-b6ab-743ce54e4499", "name": "Unix Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.004", "url": "https://attack.mitre.org/techniques/T1059/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009", "name": "Visual Basic", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.005", "url": "https://attack.mitre.org/techniques/T1059/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.006", "url": "https://attack.mitre.org/techniques/T1059/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.007", "url": "https://attack.mitre.org/techniques/T1059/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54", "name": "Malicious Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.001", "url": "https://attack.mitre.org/techniques/T1204/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890", "name": "Malicious File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--769b0744-21ca-5afd-8b63-c44f26264020", "name": "Malicious Copy and Paste", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.004", "url": "https://attack.mitre.org/techniques/T1204/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3acbde91-aff4-5d92-8866-c8724956daf7", "name": "Malicious Library", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.005", "url": "https://attack.mitre.org/techniques/T1204/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--55fbbc32-53a9-5697-b4a2-f76eff6369e3", "name": "Launch Agent", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.001", "url": "https://attack.mitre.org/techniques/T1543/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--94dc7254-9e4b-5daa-8e48-5e863ee10716", "name": "XDG Autostart Entries", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.013", "url": "https://attack.mitre.org/techniques/T1547/013/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d2ba8d9c-b475-5eaf-a3f5-936fa2917a10", "name": "Unix Shell Configuration Modification", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1546.004", "url": "https://attack.mitre.org/techniques/T1546/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f", "name": "Command Obfuscation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.010", "url": "https://attack.mitre.org/techniques/T1027/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd", "name": "Encrypted/Encoded File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.013", "url": "https://attack.mitre.org/techniques/T1027/013/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c5af0804-83ea-5201-880d-10d5d2d60bb7", "name": "Masquerading", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036", "url": "https://attack.mitre.org/techniques/T1036/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9bd33ccc-fad0-590b-b8f1-d47d1e009365", "name": "Execution Guardrails", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1480", "url": "https://attack.mitre.org/techniques/T1480/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--426c6ee3-8d09-5217-814a-853fd802dfae", "name": "Virtualization/Sandbox Evasion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1497", "url": "https://attack.mitre.org/techniques/T1497/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4", "name": "Impersonation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1684.001", "url": "https://attack.mitre.org/techniques/T1684/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9382ab84-f748-55d1-b2bf-c9f956ab10c3", "name": "Keychain", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555.001", "url": "https://attack.mitre.org/techniques/T1555/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f7a70e71-4f55-504e-a4bb-700f593346c9", "name": "Mail Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.003", "url": "https://attack.mitre.org/techniques/T1071/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084", "name": "Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090", "url": "https://attack.mitre.org/techniques/T1090/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ae13ceb5-901d-5611-8ad5-c022909e6d35", "name": "Remote Desktop Software", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1219.002", "url": "https://attack.mitre.org/techniques/T1219/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c7288879-074a-59f8-b3d2-6ea182eeeb45", "name": "Non-Standard Port", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1571", "url": "https://attack.mitre.org/techniques/T1571/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72", "name": "Symmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573.001", "url": "https://attack.mitre.org/techniques/T1573/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b9920f06-c5bc-5834-b5a0-7aa085ea5932", "name": "Exfiltration Over Unencrypted Non-C2 Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1048.003", "url": "https://attack.mitre.org/techniques/T1048/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364", "name": "Exfiltration Over Web Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567", "url": "https://attack.mitre.org/techniques/T1567/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374", "name": "Exfiltration to Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685", "url": "https://attack.mitre.org/techniques/T1685/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b", "name": "Financial Theft", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--f94d41c8-e75c-5b85-80ae-1b41564b18f7", "name": "InvisibleFerret", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1245", "url": "https://attack.mitre.org/software/S1245/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--fb665d9c-cb8b-504e-a7b4-4177d6652b51", "name": "BeaverTail", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1246", "url": "https://attack.mitre.org/software/S1246/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--73a734f2-0efe-5e19-962d-9eec93516cba", "name": "XORIndex Loader", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1248", "url": "https://attack.mitre.org/software/S1248/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--9b08bd35-a8ae-5c7b-89d1-697a1a4b02c3", "name": "HexEval Loader", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1249", "url": "https://attack.mitre.org/software/S1249/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8ac36b63-efcd-5a8c-b72b-badcdf635c2c", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--579dca05-30ce-5de6-8f74-97cd55fe5a18" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--86ab1de3-24fe-5072-bb4d-395caa7a766b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--fc1355fb-d707-5f8e-a486-f120be2af153" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b469b28d-bb33-5a26-9b8b-75acead648a8", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b2aa4ccf-5b53-57f1-9b24-3963c06652c7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3442d303-427d-5071-b2f7-8f59fe20e7b9", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--b029bb82-521a-502a-af34-b0df33d9df9c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--363062ab-92f0-5599-896f-cc6cee79d128", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--baff43a1-be43-52dc-a7bc-4d0995b420d2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8e871921-82e3-5a83-8b5b-ea926a6062d7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1644e18a-4f73-51a3-8ca8-2589ca69ff32", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--088b304f-5c4e-5faf-8e6a-77eaff2bdcdd", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6e88bc22-a82b-5f41-b82a-566408be4a49", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--1fe7ed47-3bc0-545a-b1c5-d5d9cfb6a801" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4e7032c6-234d-5d99-88fb-e448b46f1d33", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2648fa88-c2ca-582d-88b4-a1b40671479f", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--83c2008f-492c-5e40-b7d3-89d0f2cb9d25", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8cad710e-e05b-55a0-9932-de52051e37c7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--32cee96f-2501-534f-9825-55e6a223a35e", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1403298a-71f5-50bf-8786-56860d989994", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--46e30d0b-57e5-568b-829d-fc3661d08241", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ebdfa314-7aed-53f7-89b0-401b8b8129b7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--36ee37f2-9509-5038-bdfa-156962c1bb1b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9366220f-1553-5454-9c4e-0bf61faf07f4", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--a51fd8ac-5b4b-598e-bd7a-3fae18063969" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--33ca4e5c-c9d1-56e7-85b2-7aaa2d0b900b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e80792cc-3d57-5008-b998-dff69d706d0c", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bd338589-a855-54cb-813a-65f3566fbca0", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--0968668b-c601-577e-b6ab-743ce54e4499" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5652a915-7fe3-5548-bfb8-7fd5a5747913", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2911adbc-a051-52a4-ab88-fb85959fa3b6", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--863e47f4-bf4d-540a-a52d-269390f9abf7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0eb68819-ad59-5532-ae2b-e75087f55f9b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cc060b76-4264-5e9d-887e-e8bc0ed72cb7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fd5de1e5-dc87-5104-9d66-89d47936f50b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--769b0744-21ca-5afd-8b63-c44f26264020" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6e47b298-1cc9-5f21-bb30-8ffa345720e0", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--3acbde91-aff4-5d92-8866-c8724956daf7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--94c17bef-b3dc-5580-8a8d-60bd53cc71dc", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--55fbbc32-53a9-5697-b4a2-f76eff6369e3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--96d76b6a-9246-551d-98c8-c03143c31aad", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5f6ade7b-6770-586d-a23f-fc1ed315814e", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--94dc7254-9e4b-5daa-8e48-5e863ee10716" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2573987a-9160-5c8d-824a-899e39f4728b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--d2ba8d9c-b475-5eaf-a3f5-936fa2917a10" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--10fbfcff-44bb-5a47-a847-6d0bf2d758c5", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fbb5ab4e-da02-518b-979f-9971d45d400c", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--96378b9a-d970-57ff-b1b5-b3f12a4c5575", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--c5af0804-83ea-5201-880d-10d5d2d60bb7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--975939df-873e-5d62-8f89-68172d210074", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f7ab35e4-9124-5567-a61f-e44ef055c7cf", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--9bd33ccc-fad0-590b-b8f1-d47d1e009365" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--746130f0-13cd-59eb-b7d6-8bff3edaf88f", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--426c6ee3-8d09-5217-814a-853fd802dfae" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a98c7722-c75e-50d6-b411-2568961161b7", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4fe31efc-8e7c-5d0a-a587-601963f14408", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--9382ab84-f748-55d1-b2bf-c9f956ab10c3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b181bcda-65cf-5920-abbc-e7e6f7f070b5", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--27d9bf7e-675d-5ce1-9e05-da755e138547", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--aec909a1-39a9-5fd6-9827-3f6b816aec1f", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--f7a70e71-4f55-504e-a4bb-700f593346c9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f5ec38e1-848d-53b8-8d0b-87b1ef13eaed", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c220c559-5395-51fb-b4b4-d10933de06ef", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--ae13ceb5-901d-5611-8ad5-c022909e6d35" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9ecb91b4-cc2f-596d-a545-99593dd5f6d4", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--c7288879-074a-59f8-b3d2-6ea182eeeb45" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b7c93767-0c6d-5f16-ac6e-5f4d43d0b492", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d8a45e1f-611d-5bae-b940-9239d51fcbc8", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2e7b6592-d71c-5d79-be69-8042191f6734", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--b9920f06-c5bc-5834-b5a0-7aa085ea5932" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7cec3343-8425-53e6-9245-a1efd76582a1", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3ae11158-a7d1-5b03-b6aa-53264e49c3b9", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4844393b-de47-5bfb-a162-2fdc1cf2c62d", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c44668e1-2ef4-5bcb-b1c3-a24fd5d1dee3", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4129a305-d6b3-5770-867d-4aa5608f90d0", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "malware--f94d41c8-e75c-5b85-80ae-1b41564b18f7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8ed1c0aa-0e8f-5d84-a72b-00a877a68711", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "malware--fb665d9c-cb8b-504e-a7b4-4177d6652b51" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1fded389-cc14-5857-8c41-0b5909696e5b", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "malware--73a734f2-0efe-5e19-962d-9eec93516cba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0f2f079b-ff48-5431-b136-6e5c26cf5dbc", "relationship_type": "uses", "source_ref": "intrusion-set--63051d21-9b12-5720-bc06-c4e41e40ba80", "target_ref": "malware--9b08bd35-a8ae-5c7b-89d1-697a1a4b02c3" } ] }