{ "type": "bundle", "id": "bundle--799568a0-a1a1-5fe6-9bd8-e844c86cebfc", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "name": "ENERGETIC BEAR", "aliases": [ "ENERGETIC BEAR", "BERSERK BEAR", "ALLANITE", "CASTLE", "DYMALLOY", "TG-4192", "Dragonfly", "Crouching Yeti", "Group 24", "Havex", "Koala Team", "IRON LIBERTY", "ATK6", "ITG15", "BROMINE", "Blue Kraken", "Ghost Blizzard", "TEMP.Isotope" ], "description": "A Russian group that collects intelligence on the energy industry.", "resource_level": "government", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0035", "url": "https://attack.mitre.org/groups/G0035/" }, { "source_name": "skopnix", "external_id": "energetic-bear", "url": "https://skopnix.com/actors/energetic-bear" }, { "source_name": "gov.uk", "url": "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet" }, { "source_name": "web.archive.org", "url": "https://web.archive.org/web/20161020180305/http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/" }, { "source_name": "paper.seebug.org", "url": "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf" }, { "source_name": "netresec.com", "url": "http://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans" }, { "source_name": "threatpost.com", "url": "https://threatpost.com/energy-watering-hole-attack-used-lightsout-exploit-kit/104772/" }, { "source_name": "cfr.org", "url": "https://www.cfr.org/interactive/cyber-operations/crouching-yeti" }, { "source_name": "reuters.com", "url": "https://www.reuters.com/article/us-ukraine-cyber-attack-energy-idUSKBN1521BA" }, { "source_name": "dragos.com", "url": "https://dragos.com/wp-content/uploads/CrashOverride-01.pdf" }, { "source_name": "independent.ie", "url": "https://www.independent.ie/irish-news/statesponsored-hackers-targeted-eirgrid-electricity-network-in-devious-attack-36005921.html" }, { "source_name": "riskiq.com", "url": "https://www.riskiq.com/blog/labs/energetic-bear/" }, { "source_name": "symantec-blogs.broadcom.com", "url": "https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks" }, { "source_name": "kaspersky.com", "url": "https://www.kaspersky.com/resource-center/threats/crouching-yeti-energetic-bear-malware-threat" }, { "source_name": "sans.org", "url": "https://www.sans.org/reading-room/whitepapers/ICS/impact-dragonfly-malware-industrial-control-systems-36672" }, { "source_name": "secureworks.com", "url": "https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector" }, { "source_name": "dragos.com", "url": "https://dragos.com/adversaries.html" }, { "source_name": "dragos.com", "url": "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf" }, { "source_name": "cfr.org", "url": "https://www.cfr.org/interactive/cyber-operations/dymalloy" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0035" }, { "source_name": "cisa.gov", "url": "https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions" }, { "source_name": "justice.gov", "url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical" }, { "source_name": "dragos.com", "url": "https://www.dragos.com/threat/dymalloy/" }, { "source_name": "fortune.com", "url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/ukraine-crisis-cyber-threats" }, { "source_name": "learn.microsoft.com", "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dadf23d6-f45f-540c-a41c-3a35389afc5e", "name": "Business Relationships", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1591.002", "url": "https://attack.mitre.org/techniques/T1591/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "name": "Vulnerability Scanning", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1595.002", "url": "https://attack.mitre.org/techniques/T1595/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a5481c9-2434-54d8-afa9-dfb37dd1ff58", "name": "Spearphishing Attachment", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1598.002", "url": "https://attack.mitre.org/techniques/T1598/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94", "name": "Spearphishing Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1598.003", "url": "https://attack.mitre.org/techniques/T1598/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "name": "Domains", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "name": "Virtual Private Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.003", "url": "https://attack.mitre.org/techniques/T1583/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--793786fb-a825-51b3-9892-250a0c3ae630", "name": "Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1584.004", "url": "https://attack.mitre.org/techniques/T1584/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5eff8029-9c7e-5c89-9bbe-6c862bac8540", "name": "Drive-by Target", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.004", "url": "https://attack.mitre.org/techniques/T1608/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a09471aa-93fe-54b1-a009-7912f317e600", "name": "Drive-by Compromise", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1189", "url": "https://attack.mitre.org/techniques/T1189/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734", "name": "Compromise Software Supply Chain", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9", "name": "Spearphishing Attachment", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.001", "url": "https://attack.mitre.org/techniques/T1566/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.006", "url": "https://attack.mitre.org/techniques/T1059/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d", "name": "Exploitation for Client Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1203", "url": "https://attack.mitre.org/techniques/T1203/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890", "name": "Malicious File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94", "name": "Additional Local or Domain Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.007", "url": "https://attack.mitre.org/techniques/T1098/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766", "name": "External Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.001", "url": "https://attack.mitre.org/techniques/T1136/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.003", "url": "https://attack.mitre.org/techniques/T1505/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4a4d6013-7e1b-5685-9830-1bcfd9bd4155", "name": "Masquerade Account Name", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.010", "url": "https://attack.mitre.org/techniques/T1036/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--937c936c-dad1-5473-9a9c-1096e11efd5f", "name": "Template Injection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1221", "url": "https://attack.mitre.org/techniques/T1221/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7ad860bb-6ec2-55b8-b110-b5745e49761d", "name": "Hidden Users", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1564.002", "url": "https://attack.mitre.org/techniques/T1564/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b", "name": "Security Account Manager", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.002", "url": "https://attack.mitre.org/techniques/T1003/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c", "name": "NTDS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.003", "url": "https://attack.mitre.org/techniques/T1003/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671", "name": "LSA Secrets", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.004", "url": "https://attack.mitre.org/techniques/T1003/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d", "name": "Brute Force", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711", "name": "Password Cracking", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.002", "url": "https://attack.mitre.org/techniques/T1110/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1bfcf809-bbdb-5ab1-a17c-e7b39bb2743e", "name": "Forced Authentication", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1187", "url": "https://attack.mitre.org/techniques/T1187/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf", "name": "Query Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1012", "url": "https://attack.mitre.org/techniques/T1012/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1033", "url": "https://attack.mitre.org/techniques/T1033/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3", "name": "Domain Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069.002", "url": "https://attack.mitre.org/techniques/T1069/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044", "name": "Network Share Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1135", "url": "https://attack.mitre.org/techniques/T1135/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5c91bed7-07ab-5789-8139-7d39a2020dfb", "name": "Exploitation of Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9", "name": "Local Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.001", "url": "https://attack.mitre.org/techniques/T1074/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971", "name": "Screen Capture", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1113", "url": "https://attack.mitre.org/techniques/T1113/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d", "name": "Remote Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.002", "url": "https://attack.mitre.org/techniques/T1114/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e", "name": "Archive Collected Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560", "url": "https://attack.mitre.org/techniques/T1560/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0c15effe-a89f-5d2d-8482-5118378b2aca", "name": "File Transfer Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.002", "url": "https://attack.mitre.org/techniques/T1071/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3", "name": "Modify Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1112", "url": "https://attack.mitre.org/techniques/T1112/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351", "name": "Clear Windows Event Logs", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685.005", "url": "https://attack.mitre.org/techniques/T1685/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57", "name": "Disable or Modify System Firewall", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1686", "url": "https://attack.mitre.org/techniques/T1686/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--2a4e90bb-4f70-57e8-ae67-f05c2229dcef", "name": "Backdoor.Oldrea", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0093", "url": "https://attack.mitre.org/software/S0093/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--3076f7a1-449f-5dee-a9e3-5d3a00ffd6fa", "name": "Trojan.Karagany", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0094", "url": "https://attack.mitre.org/software/S0094/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--65ce6ecd-f9dd-525d-bb7a-5a2115a399dd", "name": "MCMD", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0500", "url": "https://attack.mitre.org/software/S0500/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d", "name": "Net", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0039", "url": "https://attack.mitre.org/software/S0039/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8", "name": "Impacket", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0357", "url": "https://attack.mitre.org/software/S0357/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--e311c891-ec8b-512d-ac3a-4b69a1ebb793", "name": "CrackMapExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0488", "url": "https://attack.mitre.org/software/S0488/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--41ba4394-cd2c-5952-acbf-65751f0ecafa", "name": "Reg", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0075", "url": "https://attack.mitre.org/software/S0075/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9", "name": "netsh", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0108", "url": "https://attack.mitre.org/software/S0108/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--012561d2-2c77-5b6b-863c-d2984679fc93", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--dadf23d6-f45f-540c-a41c-3a35389afc5e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--25888c0a-3480-5fa3-9b21-9bbf4cac67aa", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--10f0a6a4-e13c-5d38-902d-fbad7c6e79d5", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--3a5481c9-2434-54d8-afa9-dfb37dd1ff58" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fadf40f2-a637-5b0e-b2f5-d8da9053f6bf", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b7bbb35d-0448-58e9-b4c5-b5999a5c5b5f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1349d179-7dbf-58eb-a814-ab4bcc16e8a0", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ffc83348-eaec-5614-9fd3-36c0fff23142", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--793786fb-a825-51b3-9892-250a0c3ae630" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--efbb1f59-6382-5c93-adde-6b278517cb3f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--265c5e92-99e7-568e-9758-f60984d3209f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5eff8029-9c7e-5c89-9bbe-6c862bac8540" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--52ba6c82-c3b6-535e-9cc8-a5a041b179e9", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--a09471aa-93fe-54b1-a009-7912f317e600" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3bb58529-5e37-53d9-a70a-411801b75ae2", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c72a0acc-fd84-5f71-8908-b01cd02fbbfb", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5423437a-431b-505e-9d43-b7bcd9f19ad8", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b295304a-41f3-57fe-ae70-dbf9727d3286", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--483b80fd-2711-5681-b877-8589a4fe1348", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--480614fe-a903-508f-a9f7-d5be99800ffa", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4fa61cad-3f66-57ef-a4d8-f684939134bb", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6092c660-861b-5bc1-bc08-9ee5a8746df6", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--da329fd0-0814-5631-826e-9db742cc9196", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f84868b1-2656-5bbb-926b-9ebcc58f9d04", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0e905724-cb0e-5ceb-b8ad-54401dcb0f00", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--98012fa4-2a54-5e71-9646-ac3c7a15254a", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8c135e67-ac4d-5245-9705-5e4f37499ec0", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0c9f3fcd-8e17-5daa-91b7-39a753086305", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--37faf5aa-1cef-5b02-b4cf-fea6c7f8d8bd", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--98a9e330-1d97-5b0e-ad6f-f4e75c45a3e5", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--4a4d6013-7e1b-5685-9830-1bcfd9bd4155" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ea71726c-ef0f-542c-9d2e-28421f7dff7f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dcc89b79-b4eb-5fbd-8e00-218dbe1a48c5", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--511b12bd-9e22-5897-a308-bac0a7e372eb", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--937c936c-dad1-5473-9a9c-1096e11efd5f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--32a8a6a5-869d-59e6-a579-a14ef744fd16", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--7ad860bb-6ec2-55b8-b110-b5745e49761d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--09e37cf8-1f1a-575c-9477-1034e03a883a", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--f0ba1038-7d10-59c9-8623-7df76c72e45b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--30c04947-3cfd-5fb7-a064-9a0900884730", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--244f5cc7-39cf-55cb-8e25-3ff0d2ec9f15", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--75417a58-c6a6-51b6-a0ac-ed34b7371671" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3c44a343-e075-5dca-b499-da5af38f0ca1", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fa1e7b0d-7623-5051-a4ed-8d12f01324e8", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--da04f6ec-5e64-58f6-a7c4-9ca8e8b7a619", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--1bfcf809-bbdb-5ab1-a17c-e7b39bb2743e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8bd4a91d-eef3-5bab-85d9-eea771e41d67", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ba8b6764-a4f3-5bd2-a2ba-c035c3f2a72d", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7fd41077-85e0-5f3e-88a2-88383c4c4f3e", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--35387fd0-0a8d-5bc3-9472-4c09f9a8e06f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--48e11981-5dd6-5ddd-bafe-c015bcd8a4b3", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--95f95c07-ff53-520b-a855-7b5467b8bb57", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--775c8e30-1222-5ca9-94e7-1b3c86879a3b", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--89ac6af8-f558-52c7-b1fc-9b44782a4cea", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--41d1e672-5fd4-50eb-8c0f-001b94567159", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ed37271e-c1a1-521b-9939-62b3841e4e62", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--5c91bed7-07ab-5789-8139-7d39a2020dfb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--54107149-db62-5f1a-8c05-8206ceafaca3", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d70f5ae3-d2bf-58eb-bc2c-a15375af8389", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cd587f7d-4076-5901-8a61-2e74455710fd", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fae0b916-8fa8-56ff-a7e0-9e483eaf5a55", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a00f0cba-84be-57b8-b814-cd0634b540f7", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cec033cb-72c1-5671-976f-9125651ce6a9", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--0c15effe-a89f-5d2d-8482-5118378b2aca" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1bebf8af-aab2-5e62-bd4c-b0f330d5d50a", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2e9e3335-b8e3-5f1f-bedd-81ff0e5c9981", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e89b9551-5f6c-518b-a907-36a5a45f3931", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8e16dad7-afa4-5a2e-8c5f-31b877ed9dab", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9229c46e-cf42-5023-9826-265a407e2c7c", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "malware--2a4e90bb-4f70-57e8-ae67-f05c2229dcef" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c3ff0d5c-d901-5c0f-b16a-ffa0868e714d", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "malware--3076f7a1-449f-5dee-a9e3-5d3a00ffd6fa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1e378fd1-bd45-5989-ae0f-83436544a611", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--65ce6ecd-f9dd-525d-bb7a-5a2115a399dd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2566414e-2d36-5ff7-b21a-b7029614d567", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ca19dcb0-dc33-50e3-9daa-c2c50bb6e18f", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7976321d-1d85-5977-aee8-933791f58298", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--e311c891-ec8b-512d-ac3a-4b69a1ebb793" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e6b94bc1-2163-5293-ab45-3e9cd4b8d33b", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--41ba4394-cd2c-5952-acbf-65751f0ecafa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8fdf4584-84b3-526f-b357-35323e0e9b36", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--42b8b295-afde-5097-9371-ae201df7d6fe", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5fa24245-e082-5094-8ee0-0ddffb6c0b20", "relationship_type": "uses", "source_ref": "intrusion-set--824f90f8-afec-54ee-81db-5333ddbb6881", "target_ref": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9" } ] }