{ "type": "bundle", "id": "bundle--5a7fe480-af96-56b5-b7f9-b7ddc525e712", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "name": "Medusa Group", "aliases": [ "Medusa Group" ], "description": "Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1051", "url": "https://attack.mitre.org/groups/G1051/" }, { "source_name": "skopnix", "external_id": "medusa-group", "url": "https://skopnix.com/actors/medusa-group" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1051" }, { "source_name": "cisa.gov", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a" }, { "source_name": "intel471.com", "url": "https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware" }, { "source_name": "security.com", "url": "https://www.security.com/threat-intelligence/medusa-ransomware-attacks" }, { "source_name": "securityscorecard.com", "url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74", "name": "Web Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.006", "url": "https://attack.mitre.org/techniques/T1583/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d", "name": "Social Media Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.001", "url": "https://attack.mitre.org/techniques/T1585/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98", "name": "Email Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.002", "url": "https://attack.mitre.org/techniques/T1585/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--12b842ff-01cb-5add-92fb-aaa3806590ec", "name": "Upload Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.002", "url": "https://attack.mitre.org/techniques/T1608/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--83a80f70-90e2-5300-ae8a-8615338abee7", "name": "Acquire Access", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1650", "url": "https://attack.mitre.org/techniques/T1650/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "name": "Software Deployment Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1072", "url": "https://attack.mitre.org/techniques/T1072/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61", "name": "Native API", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1106", "url": "https://attack.mitre.org/techniques/T1106/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--11ce9fb8-cf3c-569d-b2df-a7921d0b5c8a", "name": "Component Object Model", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1559.001", "url": "https://attack.mitre.org/techniques/T1559/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1569.002", "url": "https://attack.mitre.org/techniques/T1569/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.002", "url": "https://attack.mitre.org/techniques/T1136/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.003", "url": "https://attack.mitre.org/techniques/T1505/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1543.003", "url": "https://attack.mitre.org/techniques/T1543/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98", "name": "Bypass User Account Control", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1548.002", "url": "https://attack.mitre.org/techniques/T1548/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e", "name": "Software Packing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.002", "url": "https://attack.mitre.org/techniques/T1027/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f", "name": "Command Obfuscation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.010", "url": "https://attack.mitre.org/techniques/T1027/010/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--25be685b-ba69-523d-ae22-5040e28cf0a0", "name": "Clear Command History", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.003", "url": "https://attack.mitre.org/techniques/T1070/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e0565e46-70ad-500e-b013-d6b54d632e3f", "name": "MMC", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1218.014", "url": "https://attack.mitre.org/techniques/T1218/014/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393", "name": "Hidden Window", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1564.003", "url": "https://attack.mitre.org/techniques/T1564/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc", "name": "LSASS Memory", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.001", "url": "https://attack.mitre.org/techniques/T1003/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c", "name": "NTDS", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.003", "url": "https://attack.mitre.org/techniques/T1003/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1033", "url": "https://attack.mitre.org/techniques/T1033/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1046", "url": "https://attack.mitre.org/techniques/T1046/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3", "name": "Domain Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069.002", "url": "https://attack.mitre.org/techniques/T1069/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.001", "url": "https://attack.mitre.org/techniques/T1087/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044", "name": "Network Share Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1135", "url": "https://attack.mitre.org/techniques/T1135/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526", "name": "Security Software Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1518.001", "url": "https://attack.mitre.org/techniques/T1518/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--aaf609df-595b-5392-917e-87c185333662", "name": "Device Driver Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1652", "url": "https://attack.mitre.org/techniques/T1652/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03", "name": "Lateral Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1570", "url": "https://attack.mitre.org/techniques/T1570/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246", "name": "Multi-hop Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.003", "url": "https://attack.mitre.org/techniques/T1090/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541", "name": "Remote Access Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1219", "url": "https://attack.mitre.org/techniques/T1219/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed", "name": "Asymmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573.002", "url": "https://attack.mitre.org/techniques/T1573/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374", "name": "Exfiltration to Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3", "name": "Modify Registry", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1112", "url": "https://attack.mitre.org/techniques/T1112/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710", "name": "Code Signing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1553.002", "url": "https://attack.mitre.org/techniques/T1553/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685", "url": "https://attack.mitre.org/techniques/T1685/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57", "name": "Disable or Modify System Firewall", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1686", "url": "https://attack.mitre.org/techniques/T1686/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--043a38ec-4a65-5950-8e45-e6ebb3378c0c", "name": "Prevent Command History Logging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1690", "url": "https://attack.mitre.org/techniques/T1690/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83", "name": "Data Encrypted for Impact", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128", "name": "Service Stop", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66", "name": "Inhibit System Recovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e12e4364-2517-5c9a-b3db-04e39fa0414a", "name": "System Shutdown/Reboot", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1529", "url": "https://attack.mitre.org/techniques/T1529/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b", "name": "Financial Theft", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--56a5a130-934e-5d42-bdba-fd6881d4a959", "name": "Medusa Ransomware", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1244", "url": "https://attack.mitre.org/software/S1244/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6", "name": "certutil", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0160", "url": "https://attack.mitre.org/software/S0160/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--adb71aeb-77a9-581d-9060-7a3a82d271a1", "name": "Rclone", "external_references": [ { "source_name": "mitre-attack", "external_id": "S1040", "url": "https://attack.mitre.org/software/S1040/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b", "name": "Mimikatz", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0002", "url": "https://attack.mitre.org/software/S0002/" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6", "name": "PsExec", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0029", "url": "https://attack.mitre.org/software/S0029/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5e679916-e907-54f8-a537-211086b25be8", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--12999503-da5a-53dd-9c30-6da84fe0feb4", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e26f7515-384a-55d1-ae2e-35ad9bcafb94", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ffe96b68-9d9d-5ece-bfb0-a3393dcb3888", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ba519384-5417-58a0-afae-ce1de24b3abc", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--12b842ff-01cb-5add-92fb-aaa3806590ec" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9a27274f-e4f9-5179-8e20-384166f20af9", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--83a80f70-90e2-5300-ae8a-8615338abee7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6df62ff1-80b4-51d4-b104-724ec2787bfc", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2cec7053-08af-58f4-9b88-28d7d1da73c5", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4f605f5c-8804-520c-ace8-ab567bb89084", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--74577fdf-6b92-5a9b-bbe1-e392b9cdf551", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3da26a19-a2f4-5d5b-984f-53eff9eae56b", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--56195c9b-c28c-5064-843d-1690ccae5626", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--65bba8a8-1551-5704-8d1f-e30003f5c189", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--11ce9fb8-cf3c-569d-b2df-a7921d0b5c8a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8b533747-13c2-5a52-8fa5-9edc1e6a69d2", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9e0cbe00-2789-5716-8a23-2f658bfa1f87", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--0101ac6e-ac4c-54f9-821b-054df5f80c70" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8854455b-99ce-5413-897a-9c1e1a93d415", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dbd0d1e8-ba58-55bc-b27f-c6da3296f6e2", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--04c587d7-c7e4-521a-b762-20b89c1d8176", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--1a1ff755-4b57-506c-8311-bb4e5dfb1a98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3782c7b0-e644-50a4-83a1-160a4864f588", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0f775bc1-5f53-599e-a0cf-c3c59ac89044", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--81dfa696-bc67-5b0c-b1ad-10ccf3999c75", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--25be685b-ba69-523d-ae22-5040e28cf0a0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d6cc749f-c4d5-5ae9-9333-030bb16b0f28", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--019b192e-78d2-5965-a58e-d2829ab129a4", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--34d90ab7-b05b-50b7-91f6-80cb75e5ae90", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--e0565e46-70ad-500e-b013-d6b54d632e3f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--54089dd1-0001-504e-bc48-4c5e7c008b8a", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--17acf6fe-f3f7-5843-b08e-0d026e665393" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c94148ea-9f89-5e69-9d73-fc08eafa68bc", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c662006a-9609-50a7-a905-5e43450ee4f1", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--c98dea22-e12d-591b-abb2-d7c2068e862c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--10f7e841-ba2d-5bde-a9ee-993b2b4e79f4", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--50cf3e98-0c2a-5674-9f57-94e4d0c31888", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f008579a-db10-5375-8f4a-995957ed1fac", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a281f1d5-2738-5a8c-a22d-5695263a6e74", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c327d470-8c27-5716-94f1-5e84a0b0fbf7", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e8e6f32d-a8e6-5207-81e0-f39b67d2ccd6", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--5f933c84-7946-520a-865a-ccd26dd146b3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--647d62aa-2db0-555b-a384-d9ef71b57480", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4c8b35c1-86aa-5f10-bdc5-66d78aac091a", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--14a9d6ea-6598-5ccd-8012-a95ba79c0c07", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1545a5aa-d768-56b0-a5eb-870251ee70e4", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--bbc3fae3-ef14-5081-8415-be8a18b6d044" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--56b7b981-ce68-5e09-a9dd-341ab81b2141", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c22b5290-6064-52f6-9fe6-56f6fac477b3", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--aaf609df-595b-5392-917e-87c185333662" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2ce1c095-1497-5edb-bec3-21c8cbcfe937", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a96e8dde-38ca-5b99-8aa2-387c390614d5", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f9f94d89-efdd-5129-888b-a67942aa6dd2", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--47c3d2b8-1cef-5144-b84c-bc9abaa17fbc", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ab1ac128-b7e7-5e8a-9fa7-b68cb770e3fe", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--986f7e8d-eb0d-5647-8198-420821d6f9f1", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--657ed993-9d9f-599e-870c-2f7d907c773b", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--34fc4369-802d-5a85-829b-89b8be9a739f", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6ffab7ec-b535-5e94-8202-6964958cca73", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--3c0fc898-93f4-5224-920a-1092aeca41a3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--43f9b747-47ba-59fd-9149-ec48735d4088", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9a7ba1a7-ba04-58b5-8ef6-24eaf3513b9a", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0534c191-7755-5942-ad86-c4d9f9dbc7fb", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b01ddaaf-08f0-546c-bc17-ebde781d3032", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--043a38ec-4a65-5950-8e45-e6ebb3378c0c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--07768eb6-7769-53a4-a9ed-8e3607351ae4", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cb5d314e-bd78-5829-9cf3-2e1f4430d381", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--6fa44b71-037e-5057-9388-e47c8d458128" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9edff24b-8354-51d9-bdbc-24ffdde0a100", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4155022b-a53b-542e-8b90-4313a3a04da9", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--e12e4364-2517-5c9a-b3db-04e39fa0414a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--42542dfd-a2f8-5d31-9343-19623632cabc", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--06d21f13-97cd-5a13-9fda-543e92a938a8", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "malware--56a5a130-934e-5d42-bdba-fd6881d4a959" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ca89bfa4-28f3-5bf4-9324-c034d464c277", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "tool--7f75b1a5-2a8e-5acc-995a-55f3c9a92df6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8b6c5677-d06e-5542-b535-a5ada353d32b", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "tool--adb71aeb-77a9-581d-9060-7a3a82d271a1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--40794b48-5ea8-56eb-aa34-f2eae42965da", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--195ec1ca-be39-5bf5-90a5-85a08b8e7df1", "relationship_type": "uses", "source_ref": "intrusion-set--715f4f46-6760-598d-9f72-d43610d7a459", "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6" } ] }