{ "type": "bundle", "id": "bundle--53415d54-d6e2-5b96-91df-bd5af1b4be75", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "name": "FIN6", "aliases": [ "FIN6", "SKELETON SPIDER", "ITG08", "MageCart Group 6", "White Giant", "GOLD FRANKLIN", "ATK88", "Camouflage Tempest", "TA4557", "Storm-0538", "SQUID COMET", "TAAL" ], "description": "FIN is a group targeting financial assets including assets able to do financial transaction including PoS.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G0037", "url": "https://attack.mitre.org/groups/G0037/" }, { "source_name": "skopnix", "external_id": "fin6", "url": "https://skopnix.com/actors/fin6" }, { "source_name": "www2.fireeye.com", "url": "https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf" }, { "source_name": "fireeye.com", "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html" }, { "source_name": "securityintelligence.com", "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/" }, { "source_name": "secureworks.com", "url": "http://www.secureworks.com/research/threat-profiles/gold-franklin" }, { "source_name": "crowdstrike.com", "url": "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/" }, { "source_name": "proofpoint.com", "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-recruiters-directly-email" }, { "source_name": "proofpoint.com", "url": "https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G0037" }, { "source_name": "crowdstrike.lookbookhq.com", "url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report" }, { "source_name": "web.archive.org", "url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf" }, { "source_name": "learn.microsoft.com", "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide" }, { "source_name": "securityintelligence.com", "url": "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9", "name": "Spearphishing Attachment", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.001", "url": "https://attack.mitre.org/techniques/T1566/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd", "name": "Spearphishing via Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.003", "url": "https://attack.mitre.org/techniques/T1566/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.007", "url": "https://attack.mitre.org/techniques/T1059/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890", "name": "Malicious File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1569.002", "url": "https://attack.mitre.org/techniques/T1569/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f", "name": "Command Obfuscation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.010", "url": "https://attack.mitre.org/techniques/T1027/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48", "name": "Masquerade Task or Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.004", "url": "https://attack.mitre.org/techniques/T1036/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a001fa57-9a68-56a2-ad2a-093a86c4ad03", "name": "Access Token Manipulation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1134", "url": "https://attack.mitre.org/techniques/T1134/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc", "name": "LSASS Memory", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.001", "url": "https://attack.mitre.org/techniques/T1003/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c", "name": "NTDS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.003", "url": "https://attack.mitre.org/techniques/T1003/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711", "name": "Password Cracking", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.002", "url": "https://attack.mitre.org/techniques/T1110/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d", "name": "Credentials from Password Stores", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555", "url": "https://attack.mitre.org/techniques/T1555/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290", "name": "Credentials from Web Browsers", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555.003", "url": "https://attack.mitre.org/techniques/T1555/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1046", "url": "https://attack.mitre.org/techniques/T1046/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a", "name": "Remote Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.002", "url": "https://attack.mitre.org/techniques/T1074/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab", "name": "Automated Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1119", "url": "https://attack.mitre.org/techniques/T1119/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6cda6ad3-09fe-5306-b810-90655cbe6a90", "name": "Databases", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.006", "url": "https://attack.mitre.org/techniques/T1213/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e", "name": "Archive Collected Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560", "url": "https://attack.mitre.org/techniques/T1560/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b", "name": "Archive via Custom Method", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.003", "url": "https://attack.mitre.org/techniques/T1560/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403", "name": "Non-Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1095", "url": "https://attack.mitre.org/techniques/T1095/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--63a593e5-948e-5461-bf09-5e65f1705fa3", "name": "Web Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1102", "url": "https://attack.mitre.org/techniques/T1102/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b", "name": "Protocol Tunneling", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1572", "url": "https://attack.mitre.org/techniques/T1572/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed", "name": "Asymmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573.002", "url": "https://attack.mitre.org/techniques/T1573/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b9920f06-c5bc-5834-b5a0-7aa085ea5932", "name": "Exfiltration Over Unencrypted Non-C2 Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1048.003", "url": "https://attack.mitre.org/techniques/T1048/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710", "name": "Code Signing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1553.002", "url": "https://attack.mitre.org/techniques/T1553/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685", "url": "https://attack.mitre.org/techniques/T1685/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--b5ca1a42-ffbf-5e34-b32b-0d951afd17bc", "name": "FlawedAmmyy", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0381", "url": "https://attack.mitre.org/software/S0381/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--b17ef35d-11d3-50e5-86f2-0cb50ae966d8", "name": "GrimAgent", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0632", "url": "https://attack.mitre.org/software/S0632/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--e0e070e3-caf4-5c93-9f11-3e9593bbd5ca", "name": "FrameworkPOS", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0503", "url": "https://attack.mitre.org/software/S0503/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--c86770a7-d5ea-531d-be23-8964191255d4", "name": "More_eggs", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0284", "url": "https://attack.mitre.org/software/S0284/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6", "name": "Cobalt Strike", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0154", "url": "https://attack.mitre.org/software/S0154/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--4fe5c81b-bc0c-592b-9272-1b716f17d891", "name": "Maze", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0449", "url": "https://attack.mitre.org/software/S0449/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--de1d217c-f6de-5e5e-bbb9-90169759115f", "name": "LockerGoga", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0372", "url": "https://attack.mitre.org/software/S0372/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--2e100562-f848-5718-a6ca-1d8b309b656a", "name": "Ryuk", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S0446", "url": "https://attack.mitre.org/software/S0446/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--438415ab-b025-5f6f-a0a9-7297ca9ac061", "name": "Windows Credential Editor", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0005", "url": "https://attack.mitre.org/software/S0005/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d", "name": "AdFind", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0552", "url": "https://attack.mitre.org/software/S0552/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ba97f562-2435-5f74-9298-bb3c26ea5927", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--26a8ccfc-1ade-5192-b382-64fb6d042efc", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c0c3ece0-eda2-59b3-adec-6553bbcafd7b", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ae748ec8-8858-5a3c-bac1-e24fe5e0c970", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--534fba25-9c16-540e-806f-762e2d5ca22e", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--18fea3d0-9486-5c40-9d18-1f4849f75529", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2543fed3-5389-59d6-88e4-decb20965b5c", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bd0289ad-a842-59c7-be5c-a2b482bdbb80", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cf0df582-a9af-5e9e-a066-612843570c9d", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d1a1d4d9-0f43-5849-8d9a-9b3347c766b8", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c2b06356-3db7-5454-8553-f1531c5552c4", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8f0a5dd2-2dae-5c10-84a0-0b19ba9e9a35", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d4956793-86ec-5c5c-a4da-0079a14f2b84", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--54399116-df9c-531a-87e6-82f3c2ded080", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--206bce29-e458-557a-bf91-4427a2efe193", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5c644bc0-4e81-574f-9eae-5e9eee6ee896", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d242d83a-e2e8-5be7-b54f-506b4c9232c0", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3fc3efd9-1015-5b95-9074-aef18af695a1", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--a001fa57-9a68-56a2-ad2a-093a86c4ad03" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0fb874a1-a174-5ae3-a09c-19a53724d3a4", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fd81d934-0514-586e-adfa-5e1d5cd74687", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--785e1308-55e6-598b-82d3-23c8a2062caa", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--36fae1d8-5fe4-5915-b864-cec6ccbf9711" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a2f79764-fb9f-552e-b414-0bac6dfd4a4b", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ebf80666-daab-55f5-853e-ec5960bf7c2e", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--92065168-b676-5466-a6ae-c300e6d703f7", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ff00d2b2-202b-52ab-bd6f-d5b7128bc715", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a88be8e7-1eed-50a0-aaa6-2594f76c0af9", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5fa1d63b-066c-5982-ae40-c31c83f9be07", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--feff61a1-7a5c-54a4-8e00-95ea6879e70e", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bebfae50-d684-522f-9a9c-13f3fc36cd51", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--193b9d7a-96f0-5bc4-bc02-93686502534f", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9b837905-effa-56ca-a5bd-3d248466e769", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--6cda6ad3-09fe-5306-b810-90655cbe6a90" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--961c0313-a3af-5e01-9dcc-91ecf8cf14d8", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--d57c803d-0a4a-5af4-ab4b-decd95edf84e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7cb1cf2c-7577-5435-89f9-ea469b8438fe", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5fe0c9aa-ef3f-5ad3-a7d6-97108e48ea03", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--28d2ab93-bca8-5f38-af0f-ea67dc127feb", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--63a593e5-948e-5461-bf09-5e65f1705fa3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3d974426-70d7-54e7-bd8f-6e0a834938ac", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e8f5964d-c0d8-5e63-a94d-1f98805be9d0", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e5f3c052-0d93-54ea-b48f-ca77bc97c1cd", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--b9920f06-c5bc-5834-b5a0-7aa085ea5932" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--18a8bb56-1b94-50fd-a9d4-3117bc097f6e", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bde77f64-41e8-567e-8feb-97bc8d3a7a8e", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--778d6bf0-6af3-5a58-95fb-81dab7df95cc", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--b5ca1a42-ffbf-5e34-b32b-0d951afd17bc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--edaf19d4-debf-5aab-828a-c93dbb597224", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--b17ef35d-11d3-50e5-86f2-0cb50ae966d8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--eb55760a-9fe7-592f-a71d-9b39c3ce4336", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--e0e070e3-caf4-5c93-9f11-3e9593bbd5ca" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--defb5306-e861-5bec-b0fb-75feebba07e5", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--c86770a7-d5ea-531d-be23-8964191255d4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--379b48aa-a099-550e-a536-1e91a9d42191", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--63626a54-5714-5719-85ef-cd1dc588da94", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--4fe5c81b-bc0c-592b-9272-1b716f17d891" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ef7d6672-ee3e-5096-941c-7bed39dffd64", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--de1d217c-f6de-5e5e-bbb9-90169759115f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f95190fc-23b4-5eaf-8445-3ae799d2eaa2", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "malware--2e100562-f848-5718-a6ca-1d8b309b656a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dfed57d2-d9ac-5e02-b97f-48261361c543", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "tool--438415ab-b025-5f6f-a0a9-7297ca9ac061" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a59d2fec-4645-5ca2-88af-4570299511c4", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--27bf7a07-17d5-54c9-ac14-35debee3233b", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8f389c44-edfb-5d3c-b856-ea0b91c19c84", "relationship_type": "uses", "source_ref": "intrusion-set--cbfa70ef-8b0e-53f5-97af-5cad6bd104b4", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" } ] }