{
  "type": "bundle",
  "id": "bundle--8e938f8e-cc6f-58ee-aaca-c47d414e13a0",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "name": "MosesStaff",
      "aliases": [
        "MosesStaff",
        "Moses Staff",
        "Marigold Sandstorm",
        "DEV-0500",
        "VENGEFUL KITTEN"
      ],
      "description": "Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1009",
          "url": "https://attack.mitre.org/groups/G1009/"
        },
        {
          "source_name": "skopnix",
          "external_id": "mosesstaff",
          "url": "https://skopnix.com/actors/mosesstaff"
        },
        {
          "source_name": "twitter.com",
          "url": "https://twitter.com/campuscodi/status/1450455259202166799"
        },
        {
          "source_name": "research.checkpoint.com",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        },
        {
          "source_name": "cybereason.com",
          "url": "https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
        },
        {
          "source_name": "fortinet.com",
          "url": "https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1009"
        },
        {
          "source_name": "cybereason.com",
          "url": "https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df",
      "name": "Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.001",
          "url": "https://attack.mitre.org/techniques/T1587/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9",
      "name": "Exploit Public-Facing Application",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d",
      "name": "Web Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.003",
          "url": "https://attack.mitre.org/techniques/T1505/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd",
      "name": "Encrypted/Encoded File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.013",
          "url": "https://attack.mitre.org/techniques/T1027/013/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609",
      "name": "Local Account",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1087.001",
          "url": "https://attack.mitre.org/techniques/T1087/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee",
      "name": "SMB/Windows Admin Shares",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.002",
          "url": "https://attack.mitre.org/techniques/T1021/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710",
      "name": "Code Signing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.002",
          "url": "https://attack.mitre.org/techniques/T1553/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1fdf5262-e0b8-5411-882c-33f6e48697b0",
      "name": "Windows Host Firewall",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1686.003",
          "url": "https://attack.mitre.org/techniques/T1686/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--e798d5e3-96b9-5079-b0ef-fc5ba7125d17",
      "name": "PyDCrypt",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1032",
          "url": "https://attack.mitre.org/software/S1032/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--9f36d45e-a619-5de7-9b14-5f89ead84486",
      "name": "DCSrv",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1033",
          "url": "https://attack.mitre.org/software/S1033/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--c10898e4-3017-5a87-8cb9-6cfa883062b7",
      "name": "StrifeWater",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1034",
          "url": "https://attack.mitre.org/software/S1034/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--26c1e0e4-9770-51b5-a94a-0bb872f5562a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3e67a92e-ddb4-51ab-8474-4e1474b423cd",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e315a005-5cb5-517e-b7b9-108ebc8f87d4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c2046441-97c7-5ff4-a60b-179b97e73454",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--63473677-c57a-552d-914a-ac668c69adbd",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c864e087-5397-5d8f-944a-4c4cb22e2db6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--265a79b6-551c-5705-88fc-c7bf1ee7ae65",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--344b333a-37d8-57ce-b414-ba45eac4fdc8",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--271c040b-7852-5fd6-8333-972a820e0707",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c2cca1a3-0cd7-50d8-9ee9-08be4b01c928",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc7bb747-2675-51c0-b062-7159a3ee7b09",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--352754b6-8cf8-5992-910a-11525df9d710"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9bb78a9e-0b33-5ccc-ac0e-cf4a89a35522",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "attack-pattern--1fdf5262-e0b8-5411-882c-33f6e48697b0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5ffacfe0-16a5-5d78-8ad8-6ba93cbbb622",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "malware--e798d5e3-96b9-5079-b0ef-fc5ba7125d17"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--078507f2-586a-5d5a-ab9e-dfef0cc04962",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "malware--9f36d45e-a619-5de7-9b14-5f89ead84486"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--62db8b1d-1900-5426-8817-ca884e902570",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "malware--c10898e4-3017-5a87-8cb9-6cfa883062b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9d5de929-077f-5518-a924-5396ef584a72",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--29bc7d83-376f-5a54-afd9-83c6319565fc",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    }
  ]
}