{ "type": "bundle", "id": "bundle--8c52eeaa-6b1d-5960-b4ab-81f9310fb95c", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "name": "ShinyHunters", "aliases": [ "ShinyHunters", "UNC6240", "Bling Libra" ], "description": "ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies. ShinyHunters typically uses phishing attacks and exploit kits to gain access to victim networks, where they deploy malware to steal sensitive data, such as names, addresses, phone numbers, Social Security numbers, and credit card information.", "first_seen": "2026-06-09T19:26:21.804Z", "last_seen": "2026-09-24T08:44:48.048Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1057", "url": "https://attack.mitre.org/groups/G1057/" }, { "source_name": "skopnix", "external_id": "shinyhunters", "url": "https://skopnix.com/actors/shinyhunters" }, { "source_name": "cyberwarzone.com", "url": "https://cyberwarzone.com/shinyhunters-22-year-old-member-pleads-guilty-to-cyber-extortion-causing-6-million-in-damage/" }, { "source_name": "bitdefender.com", "url": "https://www.bitdefender.com/blog/hotforsecurity/pizza-hut-australia-leaks-one-million-customers-details-claims-shinyhunters-hacking-group/" }, { "source_name": "justice.gov", "url": "https://www.justice.gov/usao-wdwa/pr/alleged-french-cybercriminal-appear-seattle-indictment-conspiracy-computer-intrusion" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1057" }, { "source_name": "blog.eclecticiq.com", "url": "https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications" }, { "source_name": "ic3.gov", "url": "https://www.ic3.gov/PSA/2026/PSA260515" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion" }, { "source_name": "intel471.com", "url": "https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack" }, { "source_name": "unit42.paloaltonetworks.com", "url": "https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8", "name": "Credentials", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1589.001", "url": "https://attack.mitre.org/techniques/T1589/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f", "name": "Code Repositories", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1593.003", "url": "https://attack.mitre.org/techniques/T1593/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "name": "Vulnerability Scanning", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1595.002", "url": "https://attack.mitre.org/techniques/T1595/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31", "name": "Phishing for Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1598", "url": "https://attack.mitre.org/techniques/T1598/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94", "name": "Spearphishing Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1598.003", "url": "https://attack.mitre.org/techniques/T1598/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "name": "Domains", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fff3ca67-d519-527c-a4ab-5d9350cfe7e2", "name": "Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.004", "url": "https://attack.mitre.org/techniques/T1583/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98", "name": "Email Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.002", "url": "https://attack.mitre.org/techniques/T1585/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5b07cc88-411d-5f39-9102-0540a0b55660", "name": "Exploits", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.004", "url": "https://attack.mitre.org/techniques/T1587/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3", "name": "Artificial Intelligence", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.007", "url": "https://attack.mitre.org/techniques/T1588/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8cb57063-c9ce-577d-9dca-e49686d0591d", "name": "Compromise Software Dependencies and Development Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1195.001", "url": "https://attack.mitre.org/techniques/T1195/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.007", "url": "https://attack.mitre.org/techniques/T1059/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--db33eb90-8c3e-552b-a47f-606eb30f1283", "name": "Cloud API", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.009", "url": "https://attack.mitre.org/techniques/T1059/009/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "name": "Software Deployment Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1072", "url": "https://attack.mitre.org/techniques/T1072/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d", "name": "Exploitation for Client Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1203", "url": "https://attack.mitre.org/techniques/T1203/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "name": "Match Legitimate Resource Name or Location", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "name": "Cloud Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--657638be-4177-5005-8625-8611fbafe8f3", "name": "Social Engineering", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1684", "url": "https://attack.mitre.org/techniques/T1684/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d", "name": "Brute Force", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb", "name": "Steal Application Access Token", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1528", "url": "https://attack.mitre.org/techniques/T1528/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b", "name": "Credentials In Files", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0", "name": "System Network Configuration Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1016", "url": "https://attack.mitre.org/techniques/T1016/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2", "name": "Remote System Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1018", "url": "https://attack.mitre.org/techniques/T1018/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--37bb9bf6-4448-5cff-8bd1-6e7ec52d62e2", "name": "Cloud Groups", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1069.003", "url": "https://attack.mitre.org/techniques/T1069/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5e3f3707-14fa-513d-bc5e-f4229fc4b2ad", "name": "Cloud Infrastructure Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1580", "url": "https://attack.mitre.org/techniques/T1580/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--553d795c-4224-5a55-b143-b1142955a2dc", "name": "Cloud Storage Object Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1619", "url": "https://attack.mitre.org/techniques/T1619/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5c91bed7-07ab-5789-8139-7d39a2020dfb", "name": "Exploitation of Remote Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--431612f4-6f12-5de5-80dd-def2e469092b", "name": "Application Access Token", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1550.001", "url": "https://attack.mitre.org/techniques/T1550/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b6109b90-3e3d-5967-b51f-b6ac41e3ee1e", "name": "Code Repositories", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.003", "url": "https://attack.mitre.org/techniques/T1213/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6cda6ad3-09fe-5306-b810-90655cbe6a90", "name": "Databases", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.006", "url": "https://attack.mitre.org/techniques/T1213/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--26562567-f539-5ab9-863d-53536503cde8", "name": "Data from Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1530", "url": "https://attack.mitre.org/techniques/T1530/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2c631db2-4eaf-5b52-a985-69efa33e25ba", "name": "Archive via Library", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.002", "url": "https://attack.mitre.org/techniques/T1560/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246", "name": "Multi-hop Proxy", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.003", "url": "https://attack.mitre.org/techniques/T1090/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541", "name": "Remote Access Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1219", "url": "https://attack.mitre.org/techniques/T1219/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed", "name": "Asymmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573.002", "url": "https://attack.mitre.org/techniques/T1573/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364", "name": "Exfiltration Over Web Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567", "url": "https://attack.mitre.org/techniques/T1567/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36", "name": "Data Destruction", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1485", "url": "https://attack.mitre.org/techniques/T1485/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--926d5c4e-1ce3-5ae9-bb87-506daaca1bb8", "name": "Internal Defacement", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1491.001", "url": "https://attack.mitre.org/techniques/T1491/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b", "name": "Financial Theft", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ] }, { "type": "tool", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "tool--3d48199b-75b1-51d4-8931-542698067cae", "name": "Tor", "external_references": [ { "source_name": "mitre-attack", "external_id": "S0183", "url": "https://attack.mitre.org/software/S0183/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--94934e99-12b0-51bc-acce-c94a93397b04", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--8864c5fa-bc3a-52af-84fa-0b62a3ab66b8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2049718d-c260-5f4c-9064-6ae863375871", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--dc5fed67-c847-51b9-91e8-868dee99db6f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d9514631-e5a8-54ea-9f91-19281bfef9a3", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--83d26123-27ea-5752-a44c-c4b59b94ae84", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ff817e2a-690c-5cd8-8650-c189c5b0e5b4", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--815d9b46-b8ec-5239-b3c7-1f916dd96840", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--107479aa-e7af-5fd7-89f5-c267780c7a9b", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--fff3ca67-d519-527c-a4ab-5d9350cfe7e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f09937d0-7e95-5370-ae6c-a1eff7be9296", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9d4ebda4-1f5b-5479-8e97-9a5d24e4572d", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5b07cc88-411d-5f39-9102-0540a0b55660" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2781846d-8421-5865-8fb3-21a67b7d9786", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4c86989a-ed2f-5486-883c-a3976eab3dd8", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5ed7e01a-1325-5bd7-b44c-3b6ead1cb55f", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0e0a7d3b-1499-5d2f-b449-3fc7e21488bf", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--8cb57063-c9ce-577d-9dca-e49686d0591d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--47e077d9-3cb8-59a0-9c1b-7eb3c41f939e", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c932a0d5-ffbc-50e6-8bb4-8a218e13d0cc", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--db33eb90-8c3e-552b-a47f-606eb30f1283" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--913c202d-058e-5f0e-8d11-94ad48ab6e51", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--55651b2c-8cd5-5deb-b586-23732b5db25c", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bca88d58-11de-5c1d-acc5-8650378bc423", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4355802d-1078-52e2-94fd-e347bc1afd38", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8e395bfe-d287-5d43-806f-01a9b5742e99", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8076d5fc-8d5b-5ec7-8e09-1922175038b6", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0546abc2-e487-5e6c-8e0e-3492d0b0ec82", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--657638be-4177-5005-8625-8611fbafe8f3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4339f648-bffa-57b8-b3cd-907b12b03577", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6a969732-c783-5c7f-9a72-596ba50dd5d7", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--baea606b-22ff-544a-ba1b-ba3b7389882b", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--886376cb-0ced-5990-a82a-91175699306b", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--448d0844-a4f0-515e-8795-17d84a99ca01", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--ee31f4cc-6e9c-5cd9-87d7-22ada9f945f2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--dba96c83-7228-55f2-b903-95ef584385b1", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--37bb9bf6-4448-5cff-8bd1-6e7ec52d62e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e785af1c-51d1-5ab1-a4bd-4d928ce2260d", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b0555893-2b5b-595c-a21f-ffb322437698", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d920f08c-d1ff-577c-9d59-539f4b149d42", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5e3f3707-14fa-513d-bc5e-f4229fc4b2ad" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1c5c73a7-48ac-5ac5-bdcc-5bd41d55f0ab", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--553d795c-4224-5a55-b143-b1142955a2dc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a0f9e1ce-8345-5745-b280-fb41f60ddbf9", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5c91bed7-07ab-5789-8139-7d39a2020dfb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e5c76f46-62bb-5b6a-a334-45191e4bf17b", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--431612f4-6f12-5de5-80dd-def2e469092b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--47ba9d0a-5aed-5fe7-88cf-eadfff31b1b1", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--b6109b90-3e3d-5967-b51f-b6ac41e3ee1e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d17a9dfc-e028-5730-a53c-4e77541f9656", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--6cda6ad3-09fe-5306-b810-90655cbe6a90" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8dc861e9-8743-55de-972d-b1a270559775", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--26562567-f539-5ab9-863d-53536503cde8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7a7d7b2d-3bca-5f04-99d3-3c5f26bb8237", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--2c631db2-4eaf-5b52-a985-69efa33e25ba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5eb3b151-ef3b-50ee-a1eb-86e8f390a0a7", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8fb0fbc4-275b-5ad1-928c-761ff95f9707", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7af99ac8-dedc-5dcc-a75e-7710afee1aa6", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9feec111-bb65-5aa9-8b75-d2ff5e02f924", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--5fe4f41a-d868-5982-9519-dd08460e12ed" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d805add8-47d4-5c64-8256-52594cc3237c", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--ca7b15bf-f126-58cf-a2bb-e0ba0f1d8364" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--16e9fa4d-4850-5b89-aea0-160b7d4fe316", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8c53a95f-b90d-5bbc-bb9b-732e095370e1", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--926d5c4e-1ce3-5ae9-bb87-506daaca1bb8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c5fff8ab-b19c-54c4-b750-00b73b476748", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--989e73b6-3984-5e6c-8f06-defe10713579", "relationship_type": "uses", "source_ref": "intrusion-set--21538bd3-7290-5cf0-853a-7f4d30ebcdeb", "target_ref": "tool--3d48199b-75b1-51d4-8931-542698067cae" } ] }