{
  "type": "bundle",
  "id": "bundle--982c4ae6-9a58-573d-9aa1-16bbcdc5d9a9",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "name": "HAFNIUM",
      "aliases": [
        "HAFNIUM",
        "ATK233",
        "Operation Exchange Marauder",
        "Red Dev 13",
        "Silk Typhoon",
        "MURKY PANDA"
      ],
      "description": "HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA.In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0125",
          "url": "https://attack.mitre.org/groups/G0125/"
        },
        {
          "source_name": "skopnix",
          "external_id": "hafnium",
          "url": "https://skopnix.com/actors/hafnium"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers"
        },
        {
          "source_name": "volexity.com",
          "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
        },
        {
          "source_name": "splunk.com",
          "url": "https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html"
        },
        {
          "source_name": "reddit.com",
          "url": "https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers"
        },
        {
          "source_name": "blog.rapid7.com",
          "url": "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day"
        },
        {
          "source_name": "twitter.com",
          "url": "https://twitter.com/ESETresearch/status/1366862946488451088"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"
        },
        {
          "source_name": "us-cert.cisa.gov",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-062a"
        },
        {
          "source_name": "discuss.elastic.co",
          "url": "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289"
        },
        {
          "source_name": "github.com",
          "url": "https://github.com/microsoft/CSS-Exchange/tree/main/Security"
        },
        {
          "source_name": "github.com",
          "url": "https://github.com/cert-lv/exchange_webshell_detection"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits"
        },
        {
          "source_name": "msrc-blog.microsoft.com",
          "url": "https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021"
        },
        {
          "source_name": "pastebin.com",
          "url": "https://pastebin.com/J4L3r2RS"
        },
        {
          "source_name": "huntress.com",
          "url": "https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers"
        },
        {
          "source_name": "github.com",
          "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md"
        },
        {
          "source_name": "msrc-blog.microsoft.com",
          "url": "https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server"
        },
        {
          "source_name": "nextron-systems.com",
          "url": "https://www.nextron-systems.com/2021/03/06/scan-for-hafnium-exploitation-evidence-with-thor-lite"
        },
        {
          "source_name": "thedailybeast.com",
          "url": "https://www.thedailybeast.com/how-chinas-devastating-microsoft-hack-puts-us-all-at-risk"
        },
        {
          "source_name": "rnz.co.nz",
          "url": "https://www.rnz.co.nz/news/political/447239/government-points-finger-at-china-over-cyber-attacks"
        },
        {
          "source_name": "gov.uk",
          "url": "https://www.gov.uk/government/news/uk-and-allies-hold-chinese-state-responsible-for-a-pervasive-pattern-of-hacking"
        },
        {
          "source_name": "foreignminister.gov.au",
          "url": "https://www.foreignminister.gov.au/minister/marise-payne/media-release/australia-joins-international-partners-attribution-malicious-cyber-activity-china"
        },
        {
          "source_name": "query.prod.cms.rt.microsoft.com",
          "url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi"
        },
        {
          "source_name": "pwc.com",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0125"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d",
      "name": "Email Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.002",
          "url": "https://attack.mitre.org/techniques/T1589/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8b058c0f-2633-5270-bb5b-4935260d457d",
      "name": "Gather Victim Network Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1590",
          "url": "https://attack.mitre.org/techniques/T1590/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--70e43df7-8f66-5640-b5ca-a0ec3876638d",
      "name": "IP Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1590.005",
          "url": "https://attack.mitre.org/techniques/T1590/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0bb87794-32cb-5eee-8235-79dee9fcf3e5",
      "name": "Client Configurations",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1592.004",
          "url": "https://attack.mitre.org/techniques/T1592/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f",
      "name": "Code Repositories",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1593.003",
          "url": "https://attack.mitre.org/techniques/T1593/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98",
      "name": "Virtual Private Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.003",
          "url": "https://attack.mitre.org/techniques/T1583/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a7f0e4ed-6850-5ff5-8375-45afd5cd01e9",
      "name": "Botnet",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.005",
          "url": "https://attack.mitre.org/techniques/T1583/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74",
      "name": "Web Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.006",
          "url": "https://attack.mitre.org/techniques/T1583/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1d72b93e-eafa-57c4-8ca8-f95763d4226f",
      "name": "Botnet",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584.005",
          "url": "https://attack.mitre.org/techniques/T1584/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9",
      "name": "Exploit Public-Facing Application",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e",
      "name": "Trusted Relationship",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1199",
          "url": "https://attack.mitre.org/techniques/T1199/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b5352aad-0392-588c-a845-03e485c68d4c",
      "name": "Account Manipulation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1098",
          "url": "https://attack.mitre.org/techniques/T1098/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70",
      "name": "Domain Account",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1136.002",
          "url": "https://attack.mitre.org/techniques/T1136/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d",
      "name": "Web Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.003",
          "url": "https://attack.mitre.org/techniques/T1505/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c",
      "name": "Exploitation for Privilege Escalation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777",
      "name": "Local Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.003",
          "url": "https://attack.mitre.org/techniques/T1078/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd",
      "name": "Cloud Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.004",
          "url": "https://attack.mitre.org/techniques/T1078/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a",
      "name": "Rundll32",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.011",
          "url": "https://attack.mitre.org/techniques/T1218/011/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--659798b2-e80a-5489-9042-ceced73bf67e",
      "name": "Hidden Files and Directories",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.001",
          "url": "https://attack.mitre.org/techniques/T1564/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc",
      "name": "LSASS Memory",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.001",
          "url": "https://attack.mitre.org/techniques/T1003/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c",
      "name": "NTDS",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.003",
          "url": "https://attack.mitre.org/techniques/T1003/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a",
      "name": "Password Spraying",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110.003",
          "url": "https://attack.mitre.org/techniques/T1110/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--29cbfbce-15c4-59b3-8292-8ea17a7c96d5",
      "name": "Cloud Secrets Management Stores",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.006",
          "url": "https://attack.mitre.org/techniques/T1555/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a61ebb75-2aaf-5138-8cf9-ae1fc98d45b4",
      "name": "Internet Connection Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016.001",
          "url": "https://attack.mitre.org/techniques/T1016/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2",
      "name": "Remote System Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1018",
          "url": "https://attack.mitre.org/techniques/T1018/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
      "name": "Process Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b",
      "name": "File and Directory Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1083",
          "url": "https://attack.mitre.org/techniques/T1083/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--431612f4-6f12-5de5-80dd-def2e469092b",
      "name": "Application Access Token",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1550.001",
          "url": "https://attack.mitre.org/techniques/T1550/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e",
      "name": "Data from Local System",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1005",
          "url": "https://attack.mitre.org/techniques/T1005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d",
      "name": "Remote Email Collection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.002",
          "url": "https://attack.mitre.org/techniques/T1114/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab",
      "name": "Automated Collection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1119",
          "url": "https://attack.mitre.org/techniques/T1119/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6",
      "name": "Sharepoint",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1213.002",
          "url": "https://attack.mitre.org/techniques/T1213/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--26562567-f539-5ab9-863d-53536503cde8",
      "name": "Data from Cloud Storage",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1530",
          "url": "https://attack.mitre.org/techniques/T1530/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9",
      "name": "Archive via Utility",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1560.001",
          "url": "https://attack.mitre.org/techniques/T1560/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403",
      "name": "Non-Application Layer Protocol",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1095",
          "url": "https://attack.mitre.org/techniques/T1095/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1d031457-774a-5a6d-8185-83dcedf708f0",
      "name": "Standard Encoding",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1132.001",
          "url": "https://attack.mitre.org/techniques/T1132/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374",
      "name": "Exfiltration to Cloud Storage",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567.002",
          "url": "https://attack.mitre.org/techniques/T1567/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351",
      "name": "Clear Windows Event Logs",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1685.005",
          "url": "https://attack.mitre.org/techniques/T1685/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--51f82391-e483-5dc4-a0b4-57bc312ccb32",
      "name": "Tarrask",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1011",
          "url": "https://attack.mitre.org/software/S1011/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--44f4050d-6e9c-572f-b1be-3cd1c6ea0018",
      "name": "ASPXSpy",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0073",
          "url": "https://attack.mitre.org/software/S0073/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--8f77e74c-b7e9-56e7-a93f-6b75fe477c1a",
      "name": "China Chopper",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0020",
          "url": "https://attack.mitre.org/software/S0020/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8",
      "name": "Impacket",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0357",
          "url": "https://attack.mitre.org/software/S0357/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--87f3b05e-ce7b-54da-bbce-97e245b5a3b3",
      "name": "Covenant",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1155",
          "url": "https://attack.mitre.org/software/S1155/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6f95c9e6-a4e1-586c-a350-75e7b4173ba3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--99fc579f-1652-535c-91b9-9cef4b950590",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--8b058c0f-2633-5270-bb5b-4935260d457d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0812edcc-ea45-58f2-b2ee-cc59d046a7b8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--70e43df7-8f66-5640-b5ca-a0ec3876638d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3c525e65-e671-52c1-ad01-b3485b8bb874",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--0bb87794-32cb-5eee-8235-79dee9fcf3e5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0de34a4f-9dc4-5563-9806-9c3375b76972",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a0749b73-3706-5755-8daf-49347349cf34",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0146f274-f96d-50e3-830e-69081a022250",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--a7f0e4ed-6850-5ff5-8375-45afd5cd01e9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--522ae1c6-a62e-59ae-94ad-001de550b62e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9224e217-e192-5ab2-9887-8797e7568288",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--1d72b93e-eafa-57c4-8ca8-f95763d4226f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b4fe8d20-6ca8-5be9-9c5f-7eef748657ef",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6796e983-09d6-5abc-bddb-b5739aedec9d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d5f8db48-417c-555a-98da-05394d68c652",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9a2bfbb6-8342-5195-8b9b-be1a9828ed38",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b43e6b92-e5a3-5e6c-b69d-73bdf3fe909a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--b5352aad-0392-588c-a845-03e485c68d4c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0ae3260d-8ec1-5650-abde-473d04869353",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3ab560f3-c481-554c-a4ce-c04e5c543a00",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4cf8f231-1c3d-5d62-988f-50f3986cc2f1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--99d87c47-58c7-542b-8a85-bff50d52ac3e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a738dea8-8fbc-513c-bbc3-5cb55f97561b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d42de4c7-1408-56f3-a4ec-e994458945a7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ae758429-d9c8-5e43-9e61-09ee098c4240",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--659798b2-e80a-5489-9042-ceced73bf67e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9f6b969a-e0e1-5c6e-bea5-0d20a9867a4a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--54ae9ee3-8561-5d3f-aa77-02f898546c41",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b6bdb660-c1e3-5670-8c11-a68be7245c29",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0757dd5e-a34d-5761-a107-dba12dcd6701",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--29cbfbce-15c4-59b3-8292-8ea17a7c96d5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e189788d-eab9-5a87-8951-f760e1d3f3c7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9a120364-9913-50e8-9f38-9be15acf27e3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--a61ebb75-2aaf-5138-8cf9-ae1fc98d45b4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--23250154-fae5-5451-9e2e-9a5665a1dfea",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3c4c232e-eba6-5067-96b3-8ce312c863df",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--00e35748-59d4-51d3-9f21-fa2cfab693fc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cee70e96-f87c-5029-8a65-a975506d8a8f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5343e637-5c27-5c98-aae1-905420f76d5a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--431612f4-6f12-5de5-80dd-def2e469092b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--593de35d-4c5d-5ed6-9ca0-3e16c2977232",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2dc1bbbd-4433-55c7-a2f3-a8a4ce3f5d8e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--31a346dd-4966-54e3-8512-4e820b198be0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9619ea22-eac9-5282-8408-547d82bce4b8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--858a756b-b4e9-559c-8693-21f6743ba3f6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--26562567-f539-5ab9-863d-53536503cde8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--de452184-15ab-5a8a-aa62-fed19c6e2c8f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9cfa3fda-77db-52fe-9f79-d9f0011a2fb2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--145d459c-bedd-50ad-be7b-0e775d1efb31",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8609cd0b-f463-5174-a360-fc268f14b988",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--83b71932-7dfc-5333-b492-de0926b8e635",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--1d031457-774a-5a6d-8185-83dcedf708f0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a41af3c3-f64a-5ab8-9019-20699f9962c5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fae771db-a153-5b27-8bef-ef01284eaac0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6ec844f9-e40b-5575-9fb6-e19714bc598b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "malware--51f82391-e483-5dc4-a0b4-57bc312ccb32"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f9214661-3453-5186-bccf-3ff095ba4b3c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "malware--44f4050d-6e9c-572f-b1be-3cd1c6ea0018"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3237de34-fb2e-5ca0-87cb-8b0c6de83d81",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "malware--8f77e74c-b7e9-56e7-a93f-6b75fe477c1a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--af5321a6-d335-5dd0-abc0-5f9cf9e6c9b8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4ff77724-8aea-5d02-ab4f-6b7887920f9f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5af67a63-8f96-5fcf-abd8-81353388c5c7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4d459e8d-8043-5cf0-b031-55624cb15f07",
      "target_ref": "tool--87f3b05e-ce7b-54da-bbce-97e245b5a3b3"
    }
  ]
}