{
  "type": "bundle",
  "id": "bundle--680f9d7e-c2ce-52a1-80bc-e0a99c8904e1",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "name": "Kimsuky",
      "aliases": [
        "Kimsuky",
        "Velvet Chollima",
        "Black Banshee",
        "Thallium",
        "Operation Stolen Pencil",
        "APT43",
        "Emerald Sleet",
        "Springtail",
        "Sparkling Pisces",
        "TA427",
        "Earth Kumiho",
        "PatheticSlug"
      ],
      "description": "This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0094",
          "url": "https://attack.mitre.org/groups/G0094/"
        },
        {
          "source_name": "skopnix",
          "external_id": "kimsuky",
          "url": "https://skopnix.com/actors/kimsuky"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/kimsuky"
        },
        {
          "source_name": "pwc.co.uk",
          "url": "https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html"
        },
        {
          "source_name": "youtu.be",
          "url": "https://youtu.be/hAsKp43AZmM?t=1027"
        },
        {
          "source_name": "bloomberglaw.com",
          "url": "https://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1"
        },
        {
          "source_name": "netscout.com",
          "url": "https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0086/"
        },
        {
          "source_name": "us-cert.cisa.gov",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
        },
        {
          "source_name": "cybereason.com",
          "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
        },
        {
          "source_name": "mandiant.widen.net",
          "url": "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        },
        {
          "source_name": "asec.ahnlab.com",
          "url": "https://asec.ahnlab.com/en/57873/"
        },
        {
          "source_name": "asec.ahnlab.com",
          "url": "https://asec.ahnlab.com/en/61082/"
        },
        {
          "source_name": "rewterz.com",
          "url": "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-north-korean-apt-kimsuky-aka-black-banshee-active-iocs-29/"
        },
        {
          "source_name": "sentinelone.com",
          "url": "https://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-gather-strategic-intelligence-and-target-cybersecurity-professionals/"
        },
        {
          "source_name": "bsi.bund.de",
          "url": "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html"
        },
        {
          "source_name": "ctoatncsc.substack.com",
          "url": "https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-may-16b"
        },
        {
          "source_name": "symantec-enterprise-blogs.security.com",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0094"
        },
        {
          "source_name": "blog.cloudflare.com",
          "url": "https://blog.cloudflare.com/2026-threat-report/"
        },
        {
          "source_name": "global.ahnlab.com",
          "url": "https://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf"
        },
        {
          "source_name": "blog.alyac.co.kr",
          "url": "https://blog.alyac.co.kr/2234"
        },
        {
          "source_name": "asert.arbornetworks.com",
          "url": "https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"
        },
        {
          "source_name": "zdnet.com",
          "url": "https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d",
      "name": "Email Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.002",
          "url": "https://attack.mitre.org/techniques/T1589/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5c7beb1c-9a39-5bbd-a3d2-bd1a320f3db0",
      "name": "Employee Names",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.003",
          "url": "https://attack.mitre.org/techniques/T1589/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e",
      "name": "Gather Victim Org Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1591",
          "url": "https://attack.mitre.org/techniques/T1591/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807",
      "name": "Social Media",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1593.001",
          "url": "https://attack.mitre.org/techniques/T1593/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b604c143-3376-59a1-80d4-4a4e8c105ba7",
      "name": "Search Engines",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1593.002",
          "url": "https://attack.mitre.org/techniques/T1593/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a565401d-9b88-5f91-b04a-675728b9f76f",
      "name": "Search Victim-Owned Websites",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1594",
          "url": "https://attack.mitre.org/techniques/T1594/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d92f75e8-b253-59ee-bb6a-ecb3bd2fce45",
      "name": "Search Open Technical Databases",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1596",
          "url": "https://attack.mitre.org/techniques/T1596/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31",
      "name": "Phishing for Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598",
          "url": "https://attack.mitre.org/techniques/T1598/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598.003",
          "url": "https://attack.mitre.org/techniques/T1598/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fed503e1-5817-5eac-835e-07315e72fb1d",
      "name": "Query Public AI Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1682",
          "url": "https://attack.mitre.org/techniques/T1682/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--baff43a1-be43-52dc-a7bc-4d0995b420d2",
      "name": "Acquire Infrastructure",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583",
          "url": "https://attack.mitre.org/techniques/T1583/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.001",
          "url": "https://attack.mitre.org/techniques/T1583/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fff3ca67-d519-527c-a4ab-5d9350cfe7e2",
      "name": "Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.004",
          "url": "https://attack.mitre.org/techniques/T1583/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74",
      "name": "Web Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.006",
          "url": "https://attack.mitre.org/techniques/T1583/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--476b6ce0-fd0d-5247-8aff-dd773eb87d3a",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584.001",
          "url": "https://attack.mitre.org/techniques/T1584/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1fe7ed47-3bc0-545a-b1c5-d5d9cfb6a801",
      "name": "Establish Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585",
          "url": "https://attack.mitre.org/techniques/T1585/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d",
      "name": "Social Media Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.001",
          "url": "https://attack.mitre.org/techniques/T1585/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98",
      "name": "Email Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.002",
          "url": "https://attack.mitre.org/techniques/T1585/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db",
      "name": "Email Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1586.002",
          "url": "https://attack.mitre.org/techniques/T1586/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784",
      "name": "Develop Capabilities",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587",
          "url": "https://attack.mitre.org/techniques/T1587/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df",
      "name": "Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.001",
          "url": "https://attack.mitre.org/techniques/T1587/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--15abf442-a0ac-52a5-a3a8-5be11bcf75aa",
      "name": "Code Signing Certificates",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.003",
          "url": "https://attack.mitre.org/techniques/T1588/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a5d40a86-d205-58b6-9c82-944ee4f5346e",
      "name": "Exploits",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.005",
          "url": "https://attack.mitre.org/techniques/T1588/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531",
      "name": "Upload Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1608.001",
          "url": "https://attack.mitre.org/techniques/T1608/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9",
      "name": "Exploit Public-Facing Application",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f921c5f3-9eb8-5e0e-808b-8ed2a9056601",
      "name": "Phishing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566",
          "url": "https://attack.mitre.org/techniques/T1566/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.002",
          "url": "https://attack.mitre.org/techniques/T1566/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6",
      "name": "Scheduled Task",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009",
      "name": "Visual Basic",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.005",
          "url": "https://attack.mitre.org/techniques/T1059/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba",
      "name": "Python",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.006",
          "url": "https://attack.mitre.org/techniques/T1059/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c",
      "name": "JavaScript",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.007",
          "url": "https://attack.mitre.org/techniques/T1059/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61",
      "name": "Native API",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1106",
          "url": "https://attack.mitre.org/techniques/T1106/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54",
      "name": "Malicious Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.001",
          "url": "https://attack.mitre.org/techniques/T1204/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--769b0744-21ca-5afd-8b63-c44f26264020",
      "name": "Malicious Copy and Paste",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.004",
          "url": "https://attack.mitre.org/techniques/T1204/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--11ce9fb8-cf3c-569d-b2df-a7921d0b5c8a",
      "name": "Component Object Model",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1559.001",
          "url": "https://attack.mitre.org/techniques/T1559/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94",
      "name": "Additional Local or Domain Groups",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1098.007",
          "url": "https://attack.mitre.org/techniques/T1098/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766",
      "name": "External Remote Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1133",
          "url": "https://attack.mitre.org/techniques/T1133/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0",
      "name": "Local Account",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1136.001",
          "url": "https://attack.mitre.org/techniques/T1136/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0172c22a-42bf-55c1-b9c6-ee4516111413",
      "name": "Browser Extensions",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1176.001",
          "url": "https://attack.mitre.org/techniques/T1176/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d",
      "name": "Web Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.003",
          "url": "https://attack.mitre.org/techniques/T1505/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--51b9c276-bb15-55c3-94ee-75712eed7d5b",
      "name": "Change Default File Association",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.001",
          "url": "https://attack.mitre.org/techniques/T1546/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5",
      "name": "Obfuscated Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027",
          "url": "https://attack.mitre.org/techniques/T1027/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--36cd6222-d7ad-5032-a8e6-57c5ccfdd3a1",
      "name": "Binary Padding",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.001",
          "url": "https://attack.mitre.org/techniques/T1027/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e",
      "name": "Software Packing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.002",
          "url": "https://attack.mitre.org/techniques/T1027/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f3393c44-6cd2-52e7-aa07-2a771627f3ea",
      "name": "Dynamic API Resolution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.007",
          "url": "https://attack.mitre.org/techniques/T1027/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f",
      "name": "Command Obfuscation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.010",
          "url": "https://attack.mitre.org/techniques/T1027/010/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d35267d7-817f-59a7-a885-60467427b15b",
      "name": "LNK Icon Smuggling",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.012",
          "url": "https://attack.mitre.org/techniques/T1027/012/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd",
      "name": "Encrypted/Encoded File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.013",
          "url": "https://attack.mitre.org/techniques/T1027/013/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1e841714-1415-5ede-ba52-a008ffb19793",
      "name": "Compression",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.015",
          "url": "https://attack.mitre.org/techniques/T1027/015/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--88cab3a7-825b-5d5f-bd37-99f554ed67ca",
      "name": "Junk Code Insertion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.016",
          "url": "https://attack.mitre.org/techniques/T1027/016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48",
      "name": "Masquerade Task or Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.004",
          "url": "https://attack.mitre.org/techniques/T1036/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db",
      "name": "Match Legitimate Resource Name or Location",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--82cda642-f99d-573b-ae4f-041200e9c765",
      "name": "Double File Extension",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.007",
          "url": "https://attack.mitre.org/techniques/T1036/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a",
      "name": "Process Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055",
          "url": "https://attack.mitre.org/techniques/T1055/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--025157ae-afbb-5d61-8414-c12aab6084cd",
      "name": "Dynamic-link Library Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.001",
          "url": "https://attack.mitre.org/techniques/T1055/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825",
      "name": "Process Hollowing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.012",
          "url": "https://attack.mitre.org/techniques/T1055/012/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208",
      "name": "File Deletion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c",
      "name": "Timestomp",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.006",
          "url": "https://attack.mitre.org/techniques/T1070/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777",
      "name": "Local Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.003",
          "url": "https://attack.mitre.org/techniques/T1078/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4",
      "name": "Deobfuscate/Decode Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9c40be11-17cc-52b7-9897-f6b5d33be8cb",
      "name": "Traffic Signaling",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1205",
          "url": "https://attack.mitre.org/techniques/T1205/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b29f4608-ddf5-559f-8251-d82aff3ee25a",
      "name": "Mshta",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.005",
          "url": "https://attack.mitre.org/techniques/T1218/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f5e830f8-8c08-50ba-9b3d-d9b0d45f4bc4",
      "name": "Regsvr32",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.010",
          "url": "https://attack.mitre.org/techniques/T1218/010/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a",
      "name": "Rundll32",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.011",
          "url": "https://attack.mitre.org/techniques/T1218/011/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f714b6c1-67fa-5dbd-9855-5aee2f28adb8",
      "name": "Mutual Exclusion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1480.002",
          "url": "https://attack.mitre.org/techniques/T1480/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f1ef0153-cf4e-5653-8c56-840e4bb354b4",
      "name": "System Checks",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1497.001",
          "url": "https://attack.mitre.org/techniques/T1497/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7ad860bb-6ec2-55b8-b110-b5745e49761d",
      "name": "Hidden Users",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.002",
          "url": "https://attack.mitre.org/techniques/T1564/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393",
      "name": "Hidden Window",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.003",
          "url": "https://attack.mitre.org/techniques/T1564/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e6c52e39-4ba0-57c5-8718-571b666e8618",
      "name": "Ignore Process Interrupts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.011",
          "url": "https://attack.mitre.org/techniques/T1564/011/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--88cdc44d-7226-5b68-8d35-d6beff4fc755",
      "name": "Reflective Code Loading",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1620",
          "url": "https://attack.mitre.org/techniques/T1620/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--126db1c9-aec8-5044-8874-ab6baef07e31",
      "name": "Delay Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1678",
          "url": "https://attack.mitre.org/techniques/T1678/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4",
      "name": "Impersonation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1684.001",
          "url": "https://attack.mitre.org/techniques/T1684/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc",
      "name": "LSASS Memory",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.001",
          "url": "https://attack.mitre.org/techniques/T1003/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--27c66f9b-891a-51df-ab50-b378ff2ed239",
      "name": "Network Sniffing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1040",
          "url": "https://attack.mitre.org/techniques/T1040/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a",
      "name": "Multi-Factor Authentication Interception",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1111",
          "url": "https://attack.mitre.org/techniques/T1111/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7144ce5e-f430-5d09-8b8d-7a77c3c835af",
      "name": "Steal Web Session Cookie",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1539",
          "url": "https://attack.mitre.org/techniques/T1539/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b",
      "name": "Credentials In Files",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.001",
          "url": "https://attack.mitre.org/techniques/T1552/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--46d9b740-b336-5acc-a7ed-a26f4305b6fa",
      "name": "Private Keys",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.004",
          "url": "https://attack.mitre.org/techniques/T1552/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290",
      "name": "Credentials from Web Browsers",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.003",
          "url": "https://attack.mitre.org/techniques/T1555/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--37c98409-9ded-5cf6-acb5-04fbb184f072",
      "name": "Adversary-in-the-Middle",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1557",
          "url": "https://attack.mitre.org/techniques/T1557/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662",
      "name": "System Service Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1007",
          "url": "https://attack.mitre.org/techniques/T1007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf",
      "name": "Query Registry",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1012",
          "url": "https://attack.mitre.org/techniques/T1012/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
      "name": "Process Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b",
      "name": "File and Directory Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1083",
          "url": "https://attack.mitre.org/techniques/T1083/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49",
      "name": "System Time Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1124",
          "url": "https://attack.mitre.org/techniques/T1124/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55",
      "name": "Browser Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1217",
          "url": "https://attack.mitre.org/techniques/T1217/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526",
      "name": "Security Software Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1518.001",
          "url": "https://attack.mitre.org/techniques/T1518/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca",
      "name": "Local Storage Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1680",
          "url": "https://attack.mitre.org/techniques/T1680/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609",
      "name": "Remote Desktop Protocol",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.001",
          "url": "https://attack.mitre.org/techniques/T1021/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c5894c8b-3412-5bd2-890d-e8599e86517a",
      "name": "Internal Spearphishing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1534",
          "url": "https://attack.mitre.org/techniques/T1534/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159",
      "name": "Pass the Hash",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1550.002",
          "url": "https://attack.mitre.org/techniques/T1550/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e",
      "name": "Data from Local System",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1005",
          "url": "https://attack.mitre.org/techniques/T1005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590",
      "name": "Keylogging",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056.001",
          "url": "https://attack.mitre.org/techniques/T1056/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--192e28dc-945a-50bc-aac0-f46bfd9bcb07",
      "name": "Web Portal Capture",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056.003",
          "url": "https://attack.mitre.org/techniques/T1056/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9",
      "name": "Local Data Staging",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1074.001",
          "url": "https://attack.mitre.org/techniques/T1074/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971",
      "name": "Screen Capture",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1113",
          "url": "https://attack.mitre.org/techniques/T1113/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d",
      "name": "Remote Email Collection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.002",
          "url": "https://attack.mitre.org/techniques/T1114/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c6026dd7-3bfb-5cdd-b4d1-8d65070755da",
      "name": "Email Forwarding Rule",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.003",
          "url": "https://attack.mitre.org/techniques/T1114/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f3751ba7-4bbe-566d-bca5-02061a34fb6e",
      "name": "Clipboard Data",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1115",
          "url": "https://attack.mitre.org/techniques/T1115/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--eadd681f-386e-5f1c-b6c3-b32b07c7ee87",
      "name": "Browser Session Hijacking",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1185",
          "url": "https://attack.mitre.org/techniques/T1185/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9",
      "name": "Archive via Utility",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1560.001",
          "url": "https://attack.mitre.org/techniques/T1560/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b",
      "name": "Archive via Custom Method",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1560.003",
          "url": "https://attack.mitre.org/techniques/T1560/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0c15effe-a89f-5d2d-8482-5118378b2aca",
      "name": "File Transfer Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.002",
          "url": "https://attack.mitre.org/techniques/T1071/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f7a70e71-4f55-504e-a4bb-700f593346c9",
      "name": "Mail Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.003",
          "url": "https://attack.mitre.org/techniques/T1071/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb5b7e11-3d91-5d01-9d96-05c83488dea9",
      "name": "Dead Drop Resolver",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102.001",
          "url": "https://attack.mitre.org/techniques/T1102/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e",
      "name": "Bidirectional Communication",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102.002",
          "url": "https://attack.mitre.org/techniques/T1102/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--729920fc-8e5c-5780-9429-f1530d25f79b",
      "name": "Non-Standard Encoding",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1132.002",
          "url": "https://attack.mitre.org/techniques/T1132/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--ae13ceb5-901d-5611-8ad5-c022909e6d35",
      "name": "Remote Desktop Software",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1219.002",
          "url": "https://attack.mitre.org/techniques/T1219/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--2b745188-a9c2-550d-894c-640e27442269",
      "name": "Dynamic Resolution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1568",
          "url": "https://attack.mitre.org/techniques/T1568/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366",
      "name": "Automated Exfiltration",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1020",
          "url": "https://attack.mitre.org/techniques/T1020/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601",
      "name": "Exfiltration Over C2 Channel",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1041",
          "url": "https://attack.mitre.org/techniques/T1041/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374",
      "name": "Exfiltration to Cloud Storage",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567.002",
          "url": "https://attack.mitre.org/techniques/T1567/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3",
      "name": "Modify Registry",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1112",
          "url": "https://attack.mitre.org/techniques/T1112/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710",
      "name": "Code Signing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.002",
          "url": "https://attack.mitre.org/techniques/T1553/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48",
      "name": "Disable or Modify Tools",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1685",
          "url": "https://attack.mitre.org/techniques/T1685/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57",
      "name": "Disable or Modify System Firewall",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1686",
          "url": "https://attack.mitre.org/techniques/T1686/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128",
      "name": "Service Stop",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1489",
          "url": "https://attack.mitre.org/techniques/T1489/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b",
      "name": "Financial Theft",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1657",
          "url": "https://attack.mitre.org/techniques/T1657/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--7f499226-33fc-559c-a046-b0133b0a9497",
      "name": "Troll Stealer",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1196",
          "url": "https://attack.mitre.org/software/S1196/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--8943bb88-79cc-5ea5-8ef0-d1cdefb1f376",
      "name": "HTTPTroy",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S9007",
          "url": "https://attack.mitre.org/software/S9007/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--8714e362-425e-5e7d-99b7-2476efd0b504",
      "name": "Amadey",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1025",
          "url": "https://attack.mitre.org/software/S1025/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--56fcc130-a7c2-50c6-8449-7b7cb2f8fa47",
      "name": "GoBear",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1197",
          "url": "https://attack.mitre.org/software/S1197/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--e659e113-c925-519c-9a66-79e65bda25dd",
      "name": "Brave Prince",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0252",
          "url": "https://attack.mitre.org/software/S0252/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--5b08a991-4bf8-5a6d-967c-3be7c9e61aa9",
      "name": "gh0st RAT",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0032",
          "url": "https://attack.mitre.org/software/S0032/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--8dda7dc3-3bb5-5736-9f6b-b5616b493a15",
      "name": "AppleSeed",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0622",
          "url": "https://attack.mitre.org/software/S0622/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--c342f6c2-06ca-5d68-80f0-ae4e9ae6c3e4",
      "name": "Gomir",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1198",
          "url": "https://attack.mitre.org/software/S1198/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--4a46bc65-f227-539d-8c30-4b058b3190d2",
      "name": "NOKKI",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0353",
          "url": "https://attack.mitre.org/software/S0353/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--2f008049-a69f-59c7-8aa5-728c171240ad",
      "name": "Gold Dragon",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0249",
          "url": "https://attack.mitre.org/software/S0249/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--28715bfc-acb2-5380-b3de-e3537b2eabcd",
      "name": "KGH_SPY",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0526",
          "url": "https://attack.mitre.org/software/S0526/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--dab351f1-111b-5ef1-ba72-80426255474f",
      "name": "BabyShark",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0414",
          "url": "https://attack.mitre.org/software/S0414/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--218746cd-5fef-5118-85db-a5ca555fc5f9",
      "name": "TRANSLATEXT",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1201",
          "url": "https://attack.mitre.org/software/S1201/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--5bdfa812-c829-51dc-ae09-e82d42daac8a",
      "name": "schtasks",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0111",
          "url": "https://attack.mitre.org/software/S0111/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6",
      "name": "certutil",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0160",
          "url": "https://attack.mitre.org/software/S0160/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--5314cbba-ed9a-51fa-95f4-e4ab64a47e33",
      "name": "CSPY Downloader",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0527",
          "url": "https://attack.mitre.org/software/S0527/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--82b63d64-5e9d-598c-914a-b5c3c382dd96",
      "name": "QuasarRAT",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0262",
          "url": "https://attack.mitre.org/software/S0262/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ad3e4bdc-ad62-56eb-8c69-7bbf2e213e7d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a011ee8e-9a3c-52d2-ab16-9f4ba96a7f8e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5c7beb1c-9a39-5bbd-a3d2-bd1a320f3db0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--88b0bc7c-fb10-5c16-94c4-8333df597cc0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc68386f-0b58-54eb-95e0-e89b3daea57f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--50b9dda0-d986-576e-aceb-d0cdfea66738",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--b604c143-3376-59a1-80d4-4a4e8c105ba7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3c0dff06-02c9-5aeb-8e25-d02c64834b28",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--a565401d-9b88-5f91-b04a-675728b9f76f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--883c1791-b457-5c8a-a0cd-0c00b1450d87",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--d92f75e8-b253-59ee-bb6a-ecb3bd2fce45"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4e319fb5-81ed-5df5-9bef-540f9ffc85a3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8e091ac2-244e-56a0-80cd-a03c46199e47",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fe79ce81-57d4-5b4a-a31d-771c11cedc06",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--fed503e1-5817-5eac-835e-07315e72fb1d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--772bdeb4-30c2-5cf1-b414-17dd9bb0f47a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--baff43a1-be43-52dc-a7bc-4d0995b420d2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9eb1c712-ddde-5236-9758-9640732f1873",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e0a0490a-231f-5f18-9432-d614e799ee44",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--fff3ca67-d519-527c-a4ab-5d9350cfe7e2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5bdfaee4-1d44-58ac-8b7a-7842f9bd1f48",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e4aa222c-5078-59d9-abe6-428607be9aa3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--476b6ce0-fd0d-5247-8aff-dd773eb87d3a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d6ac0422-41db-5048-8bfc-fc615dbd6915",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--1fe7ed47-3bc0-545a-b1c5-d5d9cfb6a801"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--67cf9dc3-ba67-50d1-939a-4a0e44d422ad",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--02898637-1bab-531c-a525-460389e8657c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--aa12f6c6-e833-5bb0-ae3d-20874bd01515",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0a3e258b-2075-57a3-9df7-401dea359977",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--eff3bbf4-8736-547b-a422-e1dd18199f42",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--85c79887-c456-5cd2-8e98-2321361e432d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1ed2c91f-9bc8-57e5-83f1-90b69658a318",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--15abf442-a0ac-52a5-a3a8-5be11bcf75aa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--da580f67-03a1-5927-9f68-66c3da649470",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--a5d40a86-d205-58b6-9c82-944ee4f5346e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--eac02913-e1f3-5a6d-a10b-dbc42bf0c258",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--922eb288-d26d-5829-a828-354d72f45533",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--48b7a9ae-fadc-5fb0-9f0a-223fd8b9d1a7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f921c5f3-9eb8-5e0e-808b-8ed2a9056601"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--077e9581-6b13-5212-b02c-92dfa118df3f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fff60a83-5166-5188-ada4-c9b4c9b70312",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dc4e033d-b8cb-5ae1-9959-2116965d3511",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4826b6aa-d708-5b2d-a555-096b2d277590",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--15e30b16-d60e-5111-a0bf-11bfc96b7882",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3df6c2b3-1ea6-500c-a2fc-a100da3706ea",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--fe8ba2f0-edf6-5db4-a11e-6c04cb158009"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--631439de-38b8-50b3-a6c5-9d5746271632",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--56a20005-7c46-5608-b454-df4b1fbb173a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3a684a1d-ec1d-503a-a5c2-98a35d9d188d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--953515f5-2d89-5bda-87e6-f63395307c5d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--98e36fa7-2143-55e8-a6f5-6a4d7daa1d9f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d878e54d-3540-5bab-b2a4-0b0d8cf34a75",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--769b0744-21ca-5afd-8b63-c44f26264020"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--308907b9-f98e-5abd-ad69-236444eec52f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--11ce9fb8-cf3c-569d-b2df-a7921d0b5c8a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cab09d99-2a17-5700-a49b-2034a50f8b84",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--c9f27b52-924c-5d1b-a352-075a981e7e94"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3c9eb7e3-708c-5ba5-a4f7-a127a298f33f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bfa6f08f-ab4f-5509-8e2e-4511432a2f00",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--49cba2cd-81b0-5674-9823-c708985bbf41",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--0172c22a-42bf-55c1-b9c6-ee4516111413"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5a04a241-fce7-53c9-b358-3b728ca5a88d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6546b018-6616-5c6f-b866-e81e05e0ac3b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--69b1612c-00cb-5edf-b4a0-87fad9c86442",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fddc9f76-4818-5a3f-81ea-f3ca128ebfc5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--51b9c276-bb15-55c3-94ee-75712eed7d5b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a655a03f-c8ac-5a09-ba15-4852c9f8d763",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--608086a1-bf33-5739-8641-2974157b3160",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--36cd6222-d7ad-5032-a8e6-57c5ccfdd3a1"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1ee29db9-3a86-5c7d-9c8e-d66d538321ad",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e53120cd-1cd1-51ce-86c6-60c593716039",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f3393c44-6cd2-52e7-aa07-2a771627f3ea"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--740b4471-fbaf-5eba-9761-963095797af2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4173039a-b618-5455-ac60-dec5b2ee3ba2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--d35267d7-817f-59a7-a885-60467427b15b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--05afb349-3e82-502f-b81d-a9cb55ad56a1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ff469cea-ec52-54e3-8767-6ff1bf34a11e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--1e841714-1415-5ede-ba52-a008ffb19793"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f5fae2a3-c7b0-52ba-ba2f-425cd85e64d7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--88cab3a7-825b-5d5f-bd37-99f554ed67ca"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f6d1a507-e411-5438-856c-b9ed38500ec7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1f3cb4b9-e6e0-50a2-8e2d-7f4589f200d8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--987961a0-ecb1-5dac-a314-6df958f69671",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--82cda642-f99d-573b-ae4f-041200e9c765"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--46a35b1c-6723-5fc0-b0fb-60e3c3af74ab",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--79545d61-18c4-5ab6-bfd8-eeebf93f214a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8cb2dac2-02ca-5b23-87c0-18c06b520a3b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--025157ae-afbb-5d61-8414-c12aab6084cd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--16cea93d-b055-561f-8a1f-6bca5581bdc1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3985f30d-73c2-5da8-81cf-d35e39af2f6f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4d4b8c39-883c-5621-8026-b800989285ee",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ee8d0867-98d9-5ec8-b875-758c2ec23a22",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b9445c5e-1cac-5d59-be7f-95683e86ab70",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dbbae784-ab67-5693-9beb-7b08d85165cf",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--9c40be11-17cc-52b7-9897-f6b5d33be8cb"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8c302841-cf20-59c1-be49-5526def08bae",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--b29f4608-ddf5-559f-8251-d82aff3ee25a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--930bda94-6fb9-552a-b35b-67a27a0b469b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f5e830f8-8c08-50ba-9b3d-d9b0d45f4bc4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dc07c65a-0b4b-5d21-9d48-6e3da3356cba",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9eca0018-78eb-58cf-8965-7887e65d6338",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f714b6c1-67fa-5dbd-9855-5aee2f28adb8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--65976367-7f43-501f-96e3-b113f710e70b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f1ef0153-cf4e-5653-8c56-840e4bb354b4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--711e57cc-e2c1-5f5e-b5f4-fd6a860f8d97",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--7ad860bb-6ec2-55b8-b110-b5745e49761d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1a0df19b-d8a4-5f8d-8158-11798bbee823",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--12992efc-7c6c-56ea-b554-3b7bbd3d4d6a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e6c52e39-4ba0-57c5-8718-571b666e8618"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c557b8d8-4635-55df-86b0-b9ede66dd1ae",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--88cdc44d-7226-5b68-8d35-d6beff4fc755"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--14ed401a-2551-5be1-b1c1-47c1186d730d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--126db1c9-aec8-5044-8874-ab6baef07e31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ede6c20e-3884-5a8e-912e-5f0b6ef49ad4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--39ce42ce-7f22-539d-a67c-0a13b0782a08",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--04b63856-7985-5c94-acf5-fd5492ffc9ea",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--27c66f9b-891a-51df-ab50-b378ff2ed239"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bc39f77a-c08f-5c20-a7cf-abcdb427c5de",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d26d6529-2e7d-5b7f-aff0-02bb44c3b3ee",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--7144ce5e-f430-5d09-8b8d-7a77c3c835af"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a28826ae-0cbc-54d1-b71b-80288659d8ad",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dc8d082c-5b10-59d1-b227-0364f59db510",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--46d9b740-b336-5acc-a7ed-a26f4305b6fa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7fa08e0b-1d63-59d4-90d0-fb47bbffe827",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b3fd93a6-7798-5f7c-befa-f7df507f50ae",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--37c98409-9ded-5cf6-acb5-04fbb184f072"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3585dd6b-27a4-5017-bd9f-d34b2ed16e31",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--182bcba8-f27b-5322-aff5-82724075896e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bc35a554-3efe-502b-8ce0-6d3df96fadf5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8876ec3d-185f-5edb-83cd-1787426c71b8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6b622f35-4450-571b-9707-3a2e12ff1120",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--69ed7096-642f-5f89-acc6-d58985a9b7f8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--727354a8-8d35-58c6-bea6-20c73f4276a5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c4d8ea53-1a24-5539-9bcf-c1cd4a6038de",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3f953693-7ef3-58e1-8151-cb7e9fe96e4e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ac0f525d-691b-5e31-a624-cc151e609c9d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--238b2bb9-6d09-5f93-8b52-8e3a7025774f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f6197fe7-acad-512a-aa98-a410298519ca"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0ad24c46-c589-5a6d-b92a-a0fd3a3b43e7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--eeb299ef-e7e6-547a-971d-d3df89cf34b6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--c5894c8b-3412-5bd2-890d-e8599e86517a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5345ce8d-0438-59ed-a3fa-d997d4ae9cf3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--196660fe-585b-5820-a2cf-8cd178f4ba7c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f4f78a21-e58d-59ac-8f55-62c5b213e05b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--cab14c2e-0c53-58bd-98d4-58a5e68ef590"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8c5f8782-2d1a-50e9-83fa-2fd4838dbee6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--192e28dc-945a-50bc-aac0-f46bfd9bcb07"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6cee3fdb-b6eb-5994-a79b-8fca4dde942c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5ba35995-2a8c-5e87-ac2b-ca2e3ab482a2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--15a74fa7-6e05-59cf-8c38-50315cafecec",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--1229af38-63e6-55db-95c5-51e13f8b313d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a14496bc-e859-596b-a547-5ccae12fb257",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--c6026dd7-3bfb-5cdd-b4d1-8d65070755da"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f36304c1-30af-539d-a20c-5abf92339478",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f3751ba7-4bbe-566d-bca5-02061a34fb6e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7bb4ec3f-8bce-5e37-b5cd-d39831a90ccb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--eadd681f-386e-5f1c-b6c3-b32b07c7ee87"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--de9a8121-234e-53cf-a10e-799769027462",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--846d76de-6043-5151-af16-5aaaeb2cd0f6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--152e2c2e-949f-5c54-a750-fa406aaaccf7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2d39ab5f-826c-5dd8-83f7-f54c2979a321",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--0c15effe-a89f-5d2d-8482-5118378b2aca"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--af1e3c46-026e-58bf-a7c6-107d4617d427",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--f7a70e71-4f55-504e-a4bb-700f593346c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f3532072-dbf7-52cc-a32c-04febc6f940f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--cb5b7e11-3d91-5d01-9d96-05c83488dea9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7c7d29f9-b1f0-579c-8ea5-2e407c9a5c1c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bfe78c10-60de-5708-997e-2859982bbd59",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f12e8bb5-08db-5fac-bbb4-1c7ab93d2092",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--729920fc-8e5c-5780-9429-f1530d25f79b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--29215b71-9bfe-5cbd-a1ab-c026194ae26c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--ae13ceb5-901d-5611-8ad5-c022909e6d35"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dbce3d84-634b-53a5-9e13-38648a56ad40",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--2b745188-a9c2-550d-894c-640e27442269"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3d8f1b69-4480-5611-a2a6-5857d3dc2833",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--3f1ad7b0-6685-527f-8ea1-11a6d4726366"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--17269618-f3b3-53e4-8dff-48243d5a7df4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5e5736a8-45ed-5532-b570-1810d471e9cb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--aed9b378-ab23-5c0e-9910-4e320203ac00",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6fd330e7-5d3b-5327-8064-a1f960000ad8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0d072c98-1af2-5b36-9f37-4720b157c192",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--45312437-df5e-54ca-b6ae-9b53e67fa40e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1d9559a4-0c0c-5ce5-9781-0d26fd2e619a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c14465ad-b34a-5589-964f-7e2eae0f4de2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b4e4a857-945f-5c6e-a12c-b89039f2668a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--7f499226-33fc-559c-a046-b0133b0a9497"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--36073c6a-14e9-53e7-bc79-211471132bd7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--8943bb88-79cc-5ea5-8ef0-d1cdefb1f376"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e019e38c-9e27-5e1b-8526-ab331e9feb24",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--8714e362-425e-5e7d-99b7-2476efd0b504"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bec1401f-8c81-5763-9a9a-f4f31e858d2e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--56fcc130-a7c2-50c6-8449-7b7cb2f8fa47"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1380ca47-99ef-57cc-8cb7-daf7bfce0052",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--e659e113-c925-519c-9a66-79e65bda25dd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8f78643f-c72c-563d-9127-c0452caa273d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--5b08a991-4bf8-5a6d-967c-3be7c9e61aa9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--60df67a6-12e7-579f-9436-df1ab5176486",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--8dda7dc3-3bb5-5736-9f6b-b5616b493a15"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b0a0ae63-c41c-5422-ae49-20b4c8fcf871",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--c342f6c2-06ca-5d68-80f0-ae4e9ae6c3e4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7556dc56-5dba-5843-bc9e-b3c098161220",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--4a46bc65-f227-539d-8c30-4b058b3190d2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6c0296d8-3794-5b42-80ed-6b87ba264b67",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--2f008049-a69f-59c7-8aa5-728c171240ad"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--60f3cebe-b67c-5e7f-8551-4f687821c2cb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--28715bfc-acb2-5380-b3de-e3537b2eabcd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4329fa66-7396-5680-b56b-b7f8250d118c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--dab351f1-111b-5ef1-ba72-80426255474f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--37e1efae-56da-5df5-91c4-76d2b796ae80",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "malware--218746cd-5fef-5118-85db-a5ca555fc5f9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ce9efb8c-9317-500d-b3fc-246cd014bb40",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--5bdfa812-c829-51dc-ae09-e82d42daac8a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--75bd984e-4328-52a7-9452-c598e3636931",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--198e1379-60e5-5d13-b658-9e1a0cf83d7f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--5314cbba-ed9a-51fa-95f4-e4ab64a47e33"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5adb4329-e8f0-50b4-96bb-114d98df7f4f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--82b63d64-5e9d-598c-914a-b5c3c382dd96"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3a4f7b38-1f8d-5923-bc30-b457950c454b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--317ca688-a18c-5097-bb32-52837de9ee76",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--3a946073-1ece-505f-980a-6bedb9bc3ab4",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    }
  ]
}