{
  "type": "bundle",
  "id": "bundle--0e315855-1423-549c-b94d-a0d045d07337",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "name": "Stealth Falcon",
      "aliases": [
        "Stealth Falcon",
        "FruityArmor"
      ],
      "description": "This threat actor targets civil society groups and Emirati journalists, activists, and dissidents.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0038",
          "url": "https://attack.mitre.org/groups/G0038/"
        },
        {
          "source_name": "skopnix",
          "external_id": "stealth-falcon",
          "url": "https://skopnix.com/actors/stealth-falcon"
        },
        {
          "source_name": "citizenlab.ca",
          "url": "https://citizenlab.ca/2016/05/stealth-falcon/"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/stealth-falcon"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0038"
        },
        {
          "source_name": "citizenlab.org",
          "url": "https://citizenlab.org/2016/05/stealth-falcon/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5",
      "name": "Windows Management Instrumentation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1047",
          "url": "https://attack.mitre.org/techniques/T1047/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6",
      "name": "Scheduled Task",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455",
      "name": "Command and Scripting Interpreter",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059",
          "url": "https://attack.mitre.org/techniques/T1059/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d",
      "name": "Credentials from Password Stores",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555",
          "url": "https://attack.mitre.org/techniques/T1555/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290",
      "name": "Credentials from Web Browsers",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.003",
          "url": "https://attack.mitre.org/techniques/T1555/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--81a00013-942f-5768-b6b3-425445528363",
      "name": "Windows Credential Manager",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.004",
          "url": "https://attack.mitre.org/techniques/T1555/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf",
      "name": "Query Registry",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1012",
          "url": "https://attack.mitre.org/techniques/T1012/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0",
      "name": "Process Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e",
      "name": "Data from Local System",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1005",
          "url": "https://attack.mitre.org/techniques/T1005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72",
      "name": "Symmetric Cryptography",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.001",
          "url": "https://attack.mitre.org/techniques/T1573/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601",
      "name": "Exfiltration Over C2 Channel",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1041",
          "url": "https://attack.mitre.org/techniques/T1041/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3de2ab3e-40fc-5a1e-9840-3bc18484e484",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--571f0da8-a4df-5aad-af00-f0d34fde3240",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--47686ec1-3c08-5ee5-b4da-1bf527983a7d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--605209fe-92a5-5bff-9b9e-0bd2ff4e884c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f60bb8aa-97a4-5774-b244-dfd8fcafbe24",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f34df416-b8af-5a8f-9976-b8b392e28e72",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--250e6bce-6fe3-562f-92b9-2e984f0f8290"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f2bfdf70-7c38-5cfe-944b-4e5df3c92f0a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--81a00013-942f-5768-b6b3-425445528363"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8ec5a4c8-aa01-5916-8591-77444a37da29",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--2883c1c1-283b-57d1-9dfc-da5f0e29cfcf"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4ba678b4-36e4-5f1b-82bf-b7a078202f38",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f26a633a-b214-5721-b2ed-ef401a13a40c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c3b4f9f6-b173-5d2d-9bb2-ec2d90892ff4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ebf4eb15-df46-5a72-99ef-5713be6896b1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d3c0c455-50f7-53f6-b7a7-d36774041fa2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5930b1fd-2fd2-59c6-b3bc-986bef32ccdb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0a1e81ed-ed7c-5965-9412-f834801ca8f9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--02d8faee-2613-56c7-9aa6-71f7156e4a72"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--33a05b40-f1b9-501b-8e2c-6b0e9a98fb29",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--612ee86b-e90c-55e4-aef4-818c660790c7",
      "target_ref": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601"
    }
  ]
}