{
"type": "bundle",
"id": "bundle--fd87048b-564c-531c-beda-4a5fe4ce6f10",
"objects": [
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-09-07T00:00:00.000Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"name": "skopnix",
"identity_class": "organization",
"description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
"contact_information": "https://skopnix.com"
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"name": "play",
"aliases": [
"play"
],
"description": "Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.
On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs",
"first_seen": "2026-06-04T21:57:17.229Z",
"last_seen": "2026-10-04T19:37:06.566Z",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "G1040",
"url": "https://attack.mitre.org/groups/G1040/"
},
{
"source_name": "skopnix",
"external_id": "play",
"url": "https://skopnix.com/actors/play"
},
{
"source_name": "ransomware.live",
"url": "https://www.ransomware.live/"
},
{
"source_name": "attack.mitre.org",
"url": "https://attack.mitre.org/groups/G1040"
},
{
"source_name": "cisa.gov",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"
},
{
"source_name": "trendmicro.com",
"url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df",
"name": "Malware",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1587.001",
"url": "https://attack.mitre.org/techniques/T1587/001/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
"name": "Tool",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1588.002",
"url": "https://attack.mitre.org/techniques/T1588/002/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9",
"name": "Exploit Public-Facing Application",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1190",
"url": "https://attack.mitre.org/techniques/T1190/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
"name": "PowerShell",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1059.001",
"url": "https://attack.mitre.org/techniques/T1059/001/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
"name": "Windows Command Shell",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1059.003",
"url": "https://attack.mitre.org/techniques/T1059/003/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766",
"name": "External Remote Services",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1133",
"url": "https://attack.mitre.org/techniques/T1133/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f",
"name": "Command Obfuscation",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1027.010",
"url": "https://attack.mitre.org/techniques/T1027/010/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208",
"name": "File Deletion",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1070.004",
"url": "https://attack.mitre.org/techniques/T1070/004/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9",
"name": "Valid Accounts",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1078",
"url": "https://attack.mitre.org/techniques/T1078/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2",
"name": "Domain Accounts",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1078.002",
"url": "https://attack.mitre.org/techniques/T1078/002/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777",
"name": "Local Accounts",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1078.003",
"url": "https://attack.mitre.org/techniques/T1078/003/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc",
"name": "LSASS Memory",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1003.001",
"url": "https://attack.mitre.org/techniques/T1003/001/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
"name": "System Network Configuration Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1016",
"url": "https://attack.mitre.org/techniques/T1016/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2",
"name": "Remote System Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1018",
"url": "https://attack.mitre.org/techniques/T1018/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
"name": "Process Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1057",
"url": "https://attack.mitre.org/techniques/T1057/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
"name": "System Information Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1082",
"url": "https://attack.mitre.org/techniques/T1082/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b",
"name": "File and Directory Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1083",
"url": "https://attack.mitre.org/techniques/T1083/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526",
"name": "Security Software Discovery",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1518.001",
"url": "https://attack.mitre.org/techniques/T1518/001/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee",
"name": "SMB/Windows Admin Shares",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1021.002",
"url": "https://attack.mitre.org/techniques/T1021/002/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9",
"name": "Archive via Utility",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1560.001",
"url": "https://attack.mitre.org/techniques/T1560/001/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "collection"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
"name": "Ingress Tool Transfer",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1105",
"url": "https://attack.mitre.org/techniques/T1105/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--76c85798-b958-5cab-ac11-b217c90dd814",
"name": "Data Transfer Size Limits",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1030",
"url": "https://attack.mitre.org/techniques/T1030/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--47ca4aa7-f9da-51f1-97d1-19104c5ca5e7",
"name": "Exfiltration Over Alternative Protocol",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1048",
"url": "https://attack.mitre.org/techniques/T1048/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48",
"name": "Disable or Modify Tools",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1685",
"url": "https://attack.mitre.org/techniques/T1685/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351",
"name": "Clear Windows Event Logs",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1685.005",
"url": "https://attack.mitre.org/techniques/T1685/005/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
]
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b",
"name": "Financial Theft",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "T1657",
"url": "https://attack.mitre.org/techniques/T1657/"
}
],
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
]
},
{
"type": "malware",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6",
"name": "Cobalt Strike",
"is_family": true,
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0154",
"url": "https://attack.mitre.org/software/S0154/"
}
]
},
{
"type": "malware",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "malware--6833f362-df4e-5144-b563-bd824382f4dd",
"name": "Playcrypt",
"is_family": true,
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S1162",
"url": "https://attack.mitre.org/software/S1162/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--fb58f4f7-a6be-5055-86c5-6cdc10aed3e3",
"name": "Nltest",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0359",
"url": "https://attack.mitre.org/software/S0359/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d",
"name": "AdFind",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0552",
"url": "https://attack.mitre.org/software/S0552/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
"name": "PsExec",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0029",
"url": "https://attack.mitre.org/software/S0029/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--21674391-d168-52b0-b478-2ba19180b32d",
"name": "Empire",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0363",
"url": "https://attack.mitre.org/software/S0363/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--fc19e698-fce6-527e-8f1e-ba00d5abeee8",
"name": "Wevtutil",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0645",
"url": "https://attack.mitre.org/software/S0645/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef",
"name": "BloodHound",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0521",
"url": "https://attack.mitre.org/software/S0521/"
}
]
},
{
"type": "tool",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
"name": "Mimikatz",
"external_references": [
{
"source_name": "mitre-attack",
"external_id": "S0002",
"url": "https://attack.mitre.org/software/S0002/"
}
]
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--cd5afe85-ee11-56b5-a793-3b17b78ca2ea",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--847fd03c-bf55-59ef-b876-4e413d418d13",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--2ea5c100-95e0-5b5b-9466-8078bc7320c7",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--c25b1e9b-a932-5764-9916-00cebc4223b3",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--399feaec-4d25-5364-b3fd-b9bf5756b3c6",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--42b2e988-a9fa-5001-b302-729659408b72",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--74172013-f0b9-5c3a-a241-709f3c5f8766"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--2f13d637-9a95-51d8-b256-2ccb3f38d7a5",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--df0ad56d-a852-5fce-a819-8b8e0581c14f"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--5dc7cc27-cf2c-5c7b-bebc-a8fe54d2b305",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--bd28370c-ed6c-5f66-8aed-388eff61c96e",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--8bb9ad54-a34f-567f-b6f3-795f7d5f0d9d",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--694a6181-6a6a-51cb-897b-4a08afb47b25",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--9d0da538-b0a3-5016-b0d8-ff934bec2a16",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--82696738-ffc9-5c73-ac7b-667dd40372f7",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--dd83577c-3958-51e8-9347-fb157dd0db70",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--60bbc270-fcb2-5bff-b536-b1c69584aa09",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--0751bf6e-201e-542d-91ae-bfb0c0c64ef6",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--a7d7e789-ce9a-5dfa-852d-d2df1afe2f45",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--7e2c788c-06ec-5b91-ac11-e06de0be4efa",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--69661bf6-e5f4-58b3-9d21-28c4c9a3e6ae",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--c72dbe61-a0cf-5b51-8919-17cfe0f7070c",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--1d880837-c6a0-5311-9741-cab91d4d9231",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--be04370f-5bd6-5f3c-90d5-81efeca1025b",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--76c85798-b958-5cab-ac11-b217c90dd814"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--9a549e8f-f1c4-5f3f-a0ef-ab01b777fa1c",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--47ca4aa7-f9da-51f1-97d1-19104c5ca5e7"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--52ab3097-d234-5675-aa81-56265e096dec",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--eecb6dfd-dd37-5eec-8663-89049df866e2",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--c99d6641-9cd9-5776-b0b8-edccc58d7351"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--31ea985f-1edb-56e4-aa3b-8bce73e7d25a",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--7e41e1bb-8f5e-5ecf-ad13-ba30103495f3",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--434d0d45-fd57-53ac-a82f-b4426edc65b5",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "malware--6833f362-df4e-5144-b563-bd824382f4dd"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--e785c2a8-2836-5c54-bf1b-5ba00c982463",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--fb58f4f7-a6be-5055-86c5-6cdc10aed3e3"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--ae0f760a-2072-57f4-84a1-a2715c927d9e",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--790f7b84-dc31-5a5f-acdc-46e5c299d84d"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--23a0522f-e2da-52ea-9217-ab60edd73007",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--399f35bc-7c4a-53bb-bd8a-cc02743a9324",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--21674391-d168-52b0-b478-2ba19180b32d"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--c478f2c0-0030-522e-996d-95727f7e828a",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--fc19e698-fce6-527e-8f1e-ba00d5abeee8"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--1b590e74-3d7d-5810-89eb-ea0ab8475f50",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--e5d952ac-39e3-5738-a128-d3c905a11aef"
},
{
"type": "relationship",
"spec_version": "2.1",
"created": "2026-09-07T00:00:00.000Z",
"modified": "2026-10-06T13:27:36.797Z",
"created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
],
"id": "relationship--829e43b6-b436-515b-a9b7-05daffa2cf5c",
"relationship_type": "uses",
"source_ref": "intrusion-set--3b170b8a-921c-5e52-b3af-a85f450861cc",
"target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
}
]
}