{
  "type": "bundle",
  "id": "bundle--a3248a59-ca89-5830-abee-5ec7106fb31e",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "name": "LAPSUS",
      "aliases": [
        "LAPSUS",
        "LAPSUS$",
        "DEV-0537",
        "SLIPPY SPIDER",
        "Strawberry Tempest",
        "UNC3661"
      ],
      "description": "An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.",
      "first_seen": "2026-06-13T10:02:19.506Z",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1004",
          "url": "https://attack.mitre.org/groups/G1004/"
        },
        {
          "source_name": "skopnix",
          "external_id": "lapsus",
          "url": "https://skopnix.com/actors/lapsus"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
        },
        {
          "source_name": "blog.checkpoint.com",
          "url": "https://blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/adversaries/slippy-spider/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1004"
        },
        {
          "source_name": "bbc.com",
          "url": "https://www.bbc.com/news/technology-60953527"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/lapsus-group/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--579dca05-30ce-5de6-8f74-97cd55fe5a18",
      "name": "Gather Victim Identity Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589",
          "url": "https://attack.mitre.org/techniques/T1589/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8",
      "name": "Credentials",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.001",
          "url": "https://attack.mitre.org/techniques/T1589/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d",
      "name": "Email Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.002",
          "url": "https://attack.mitre.org/techniques/T1589/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dadf23d6-f45f-540c-a41c-3a35389afc5e",
      "name": "Business Relationships",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1591.002",
          "url": "https://attack.mitre.org/techniques/T1591/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b90c48c3-b67f-5c5d-9331-7bc148d645b6",
      "name": "Identify Roles",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1591.004",
          "url": "https://attack.mitre.org/techniques/T1591/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f",
      "name": "Code Repositories",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1593.003",
          "url": "https://attack.mitre.org/techniques/T1593/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--83e32add-038a-5227-9f64-92c66938bb21",
      "name": "Purchase Technical Data",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1597.002",
          "url": "https://attack.mitre.org/techniques/T1597/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--abd02ae2-c425-5cdc-9ea0-58351b37ce0c",
      "name": "Spearphishing Voice",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598.004",
          "url": "https://attack.mitre.org/techniques/T1598/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98",
      "name": "Virtual Private Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.003",
          "url": "https://attack.mitre.org/techniques/T1583/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f5ef3168-2427-569d-87d4-c409670ebf95",
      "name": "DNS Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584.002",
          "url": "https://attack.mitre.org/techniques/T1584/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db",
      "name": "Email Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1586.002",
          "url": "https://attack.mitre.org/techniques/T1586/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cd473b95-350a-5960-8aa3-0310582d7e8e",
      "name": "Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.001",
          "url": "https://attack.mitre.org/techniques/T1588/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e",
      "name": "Trusted Relationship",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1199",
          "url": "https://attack.mitre.org/techniques/T1199/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--75b003cb-d293-5a91-876f-ebc0c74e9747",
      "name": "User Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204",
          "url": "https://attack.mitre.org/techniques/T1204/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9017bef9-5745-5567-bced-d216d8163592",
      "name": "Additional Cloud Roles",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1098.003",
          "url": "https://attack.mitre.org/techniques/T1098/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766",
      "name": "External Remote Services",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1133",
          "url": "https://attack.mitre.org/techniques/T1133/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b2940dfc-768e-5b9a-aca2-94410acaec06",
      "name": "Cloud Account",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1136.003",
          "url": "https://attack.mitre.org/techniques/T1136/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c",
      "name": "Exploitation for Privilege Escalation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9",
      "name": "Valid Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078",
          "url": "https://attack.mitre.org/techniques/T1078/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd",
      "name": "Cloud Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.004",
          "url": "https://attack.mitre.org/techniques/T1078/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4",
      "name": "Impersonation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1684.001",
          "url": "https://attack.mitre.org/techniques/T1684/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c",
      "name": "NTDS",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.003",
          "url": "https://attack.mitre.org/techniques/T1003/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d1196c34-0544-59d7-9b02-0cc96f514f2f",
      "name": "DCSync",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.006",
          "url": "https://attack.mitre.org/techniques/T1003/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a",
      "name": "Multi-Factor Authentication Interception",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1111",
          "url": "https://attack.mitre.org/techniques/T1111/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--933c949b-1a90-5d2a-b57c-9a13aad62010",
      "name": "Chat Messages",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.008",
          "url": "https://attack.mitre.org/techniques/T1552/008/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290",
      "name": "Credentials from Web Browsers",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.003",
          "url": "https://attack.mitre.org/techniques/T1555/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e819d2da-777b-5885-8904-e9828a685d31",
      "name": "Password Managers",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.005",
          "url": "https://attack.mitre.org/techniques/T1555/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--41888906-2283-5bba-9d0d-fb742044633c",
      "name": "Multi-Factor Authentication Request Generation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1621",
          "url": "https://attack.mitre.org/techniques/T1621/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3",
      "name": "Domain Groups",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1069.002",
          "url": "https://attack.mitre.org/techniques/T1069/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf",
      "name": "Domain Account",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1087.002",
          "url": "https://attack.mitre.org/techniques/T1087/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e",
      "name": "Data from Local System",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1005",
          "url": "https://attack.mitre.org/techniques/T1005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c6026dd7-3bfb-5cdd-b4d1-8d65070755da",
      "name": "Email Forwarding Rule",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.003",
          "url": "https://attack.mitre.org/techniques/T1114/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9de9772c-b386-558c-9f6d-5b810e563a3c",
      "name": "Confluence",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1213.001",
          "url": "https://attack.mitre.org/techniques/T1213/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6",
      "name": "Sharepoint",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1213.002",
          "url": "https://attack.mitre.org/techniques/T1213/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b6109b90-3e3d-5967-b51f-b6ac41e3ee1e",
      "name": "Code Repositories",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1213.003",
          "url": "https://attack.mitre.org/techniques/T1213/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--2c5c3c2e-68d5-5458-a5ef-d9acbe02f588",
      "name": "Messaging Applications",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1213.005",
          "url": "https://attack.mitre.org/techniques/T1213/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084",
      "name": "Proxy",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090",
          "url": "https://attack.mitre.org/techniques/T1090/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7c247218-d5c3-5064-b1b1-ba2ec45cb94b",
      "name": "Create Cloud Instance",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1578.002",
          "url": "https://attack.mitre.org/techniques/T1578/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--80e7d529-4f9e-52f9-8051-26a48693dac2",
      "name": "Delete Cloud Instance",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1578.003",
          "url": "https://attack.mitre.org/techniques/T1578/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36",
      "name": "Data Destruction",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1485",
          "url": "https://attack.mitre.org/techniques/T1485/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128",
      "name": "Service Stop",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1489",
          "url": "https://attack.mitre.org/techniques/T1489/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--50150914-4309-55d4-9572-2b335160aff2",
      "name": "Account Access Removal",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1531",
          "url": "https://attack.mitre.org/techniques/T1531/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8217e9ef-04f3-50be-bd55-f7989a4fd714",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--579dca05-30ce-5de6-8f74-97cd55fe5a18"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ab7ab120-3a62-5640-bead-92b533c86141",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9d8a88a2-9775-5548-869d-fc6d8d2502c3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7449242a-9887-5856-9538-65f06e943150",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--dadf23d6-f45f-540c-a41c-3a35389afc5e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--30431c27-9332-5266-9d2e-11034c14b8b4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--b90c48c3-b67f-5c5d-9331-7bc148d645b6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ac413e5b-f38e-5026-8d07-6d132f6f733a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d41296e8-c7a5-5145-979f-e8d819297d14",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--83e32add-038a-5227-9f64-92c66938bb21"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--55c83130-5627-530e-bc78-12a59e5841e9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--abd02ae2-c425-5cdc-9ea0-58351b37ce0c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ecc9e861-b15f-5e90-96b4-9265573c7154",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f2ccfce5-6f1e-5b4d-b803-68edfa1a3921",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--f5ef3168-2427-569d-87d4-c409670ebf95"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ed77043b-9301-53f5-881b-cfb1483b243a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--5bb62f16-42d7-5805-9898-26d304eb65db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c2bb5747-1767-5a8c-b3b2-838a6fe6f5fa",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--cd473b95-350a-5960-8aa3-0310582d7e8e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ca5e3ef1-c1af-5cb6-b011-7dc50c85a5be",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d0bd208b-445a-5555-b3f8-39cc1970a5d0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c9a0e85e-d899-58f7-bf1e-f0f55b68105a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--75b003cb-d293-5a91-876f-ebc0c74e9747"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9808b52e-e6f4-55d0-b11a-3712de9c7206",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--9017bef9-5745-5567-bced-d216d8163592"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--028f7224-9c1a-5aea-bd50-0ad2c9efb921",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3800bae8-fbfc-5139-a32f-eff7740d87b9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--b2940dfc-768e-5b9a-aca2-94410acaec06"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--705c05e9-fd88-5fc6-b607-f522dba60569",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4d736d80-9143-568f-9dbc-62a361a6777a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--25bfdf3a-97fb-518c-a217-4838a8e8ff6b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ecb09690-efe2-5509-b801-45734845c5b1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8cc31eeb-f041-52b8-8b42-d236f1ed0ab6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc1fe212-9120-50c8-9d06-866bab66d332",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--d1196c34-0544-59d7-9b02-0cc96f514f2f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a9fa382a-498e-595f-b877-9a69d97e1d99",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--52904f1a-9c12-5fad-b971-999f2536d47a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5b58d0ad-f178-5dcb-a6e8-1b2eb70d102a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--933c949b-1a90-5d2a-b57c-9a13aad62010"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--049ae45c-5692-5ec5-82d1-cfc7771f408c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a08a164e-72c8-5cf2-a199-42e514f0dd1a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--e819d2da-777b-5885-8904-e9828a685d31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--45ffd93f-6e11-54b8-a04f-3694b4c0071b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--41888906-2283-5bba-9d0d-fb742044633c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ee3a1b37-e5c8-5c68-bea1-40ada4949154",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b7ef1d3c-0ad8-5906-bbaf-6e664435e58a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--306f584d-54ad-536b-ac56-d3d8da9cfc2c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8668beb6-5a24-5955-9404-e64b3f542456",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--c6026dd7-3bfb-5cdd-b4d1-8d65070755da"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d6cf7195-c35c-5a11-9811-797b9b41624c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--9de9772c-b386-558c-9f6d-5b810e563a3c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--410982d8-9480-5f34-ad23-2f50106c0b9c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--28849a32-54e9-59f9-b39c-0189ddd4fa5f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--b6109b90-3e3d-5967-b51f-b6ac41e3ee1e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4491e026-3a20-5306-a6c0-8b7debd90259",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--2c5c3c2e-68d5-5458-a5ef-d9acbe02f588"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--08f17009-fe0c-5e0d-83c6-49d302e45ce7",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5865343d-fca9-5c38-99f6-2cd5459d4543",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--7c247218-d5c3-5064-b1b1-ba2ec45cb94b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--25d7ea6b-dc84-5a57-8740-10923d18f2ee",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--80e7d529-4f9e-52f9-8051-26a48693dac2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--59cc1f8b-d2f1-531e-bf1d-728c83a466ee",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--55efce2c-b526-568a-9b36-5e63111a6b6b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--862ebd93-dfc8-5f49-98dc-b60e8a23e363",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "attack-pattern--50150914-4309-55d4-9572-2b335160aff2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1c9eb1f2-c8e8-5499-8b9c-997d04af45fc",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--e3bc4606-73f3-5949-b305-d51e77f4d3f8",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    }
  ]
}