{ "type": "bundle", "id": "bundle--e1f8f4cd-81eb-5420-9ac5-66ad8fe6c3cf", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "name": "UNC1549", "aliases": [ "UNC1549", "Nimbus Manticore", "TA455", "COBALT SMOKEY" ], "description": "UNC1549 is an Iranian threat actor linked to Tortoiseshell and potentially the IRGC. They have been active since at least June 2022, targeting entities worldwide with a focus on the Middle East. UNC1549 uses spear-phishing and credential harvesting for initial access, deploying custom malware like MINIBIKE and MINIBUS backdoors. They have also been observed using evasion techniques and a tunneler named LIGHTRAIL in their operations.", "first_seen": "2021-01-01T00:00:00.000Z", "last_seen": "2026-09-01T13:08:58.000Z", "resource_level": "government", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1059", "url": "https://attack.mitre.org/groups/G1059/" }, { "source_name": "skopnix", "external_id": "unc1549", "url": "https://skopnix.com/actors/unc1549" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east" }, { "source_name": "research.checkpoint.com", "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe" }, { "source_name": "blog.checkpoint.com", "url": "https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1059" }, { "source_name": "research.checkpoint.com", "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/" }, { "source_name": "research.checkpoint.com", "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east" }, { "source_name": "proofpoint.com", "url": "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution" }, { "source_name": "sophos.com", "url": "https://www.sophos.com/en-us/threat-profiles/cobalt-smokey" }, { "source_name": "clearskysec.com", "url": "https://www.clearskysec.com/irdreamjob24/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e", "name": "Gather Victim Org Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1591", "url": "https://attack.mitre.org/techniques/T1591/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1f9d7cd3-370e-5ab3-8870-d382c27a13f1", "name": "Spearphishing Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1598.001", "url": "https://attack.mitre.org/techniques/T1598/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "name": "Domains", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "name": "Virtual Private Server", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.003", "url": "https://attack.mitre.org/techniques/T1583/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74", "name": "Web Services", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.006", "url": "https://attack.mitre.org/techniques/T1583/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d", "name": "Social Media Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.001", "url": "https://attack.mitre.org/techniques/T1585/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "name": "Tool", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--15abf442-a0ac-52a5-a3a8-5be11bcf75aa", "name": "Code Signing Certificates", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.003", "url": "https://attack.mitre.org/techniques/T1588/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3", "name": "Artificial Intelligence", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.007", "url": "https://attack.mitre.org/techniques/T1588/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531", "name": "Upload Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.001", "url": "https://attack.mitre.org/techniques/T1608/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b1043dec-3b68-530f-91e6-2fc36d306002", "name": "Link Target", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.005", "url": "https://attack.mitre.org/techniques/T1608/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--063833e0-c00b-5407-8894-bc2c69859010", "name": "SEO Poisoning", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1608.006", "url": "https://attack.mitre.org/techniques/T1608/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36ee37f2-9509-5038-bdfa-156962c1bb1b", "name": "Written Content", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1683.001", "url": "https://attack.mitre.org/techniques/T1683/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a51fd8ac-5b4b-598e-bd7a-3fae18063969", "name": "Audio-Visual Content", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1683.002", "url": "https://attack.mitre.org/techniques/T1683/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e", "name": "Trusted Relationship", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9", "name": "Spearphishing Attachment", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.001", "url": "https://attack.mitre.org/techniques/T1566/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801", "name": "Spearphishing Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.002", "url": "https://attack.mitre.org/techniques/T1566/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053.005", "url": "https://attack.mitre.org/techniques/T1053/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.007", "url": "https://attack.mitre.org/techniques/T1059/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "name": "Software Deployment Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1072", "url": "https://attack.mitre.org/techniques/T1072/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61", "name": "Native API", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1106", "url": "https://attack.mitre.org/techniques/T1106/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54", "name": "Malicious Link", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.001", "url": "https://attack.mitre.org/techniques/T1204/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890", "name": "Malicious File", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b5352aad-0392-588c-a845-03e485c68d4c", "name": "Account Manipulation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098", "url": "https://attack.mitre.org/techniques/T1098/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.001", "url": "https://attack.mitre.org/techniques/T1136/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1e841714-1415-5ede-ba52-a008ffb19793", "name": "Compression", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.015", "url": "https://attack.mitre.org/techniques/T1027/015/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48", "name": "Masquerade Task or Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.004", "url": "https://attack.mitre.org/techniques/T1036/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "name": "Match Legitimate Resource Name or Location", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--268df97e-c736-5a70-b22d-0e25a8e23206", "name": "Clear Network Connection History and Configurations", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.007", "url": "https://attack.mitre.org/techniques/T1070/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777", "name": "Local Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.003", "url": "https://attack.mitre.org/techniques/T1078/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "name": "Cloud Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5", "name": "DLL", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1574.001", "url": "https://attack.mitre.org/techniques/T1574/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--35145e78-ddb5-55c8-99bb-f0da17807b1b", "name": "AppDomainManager", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1574.014", "url": "https://attack.mitre.org/techniques/T1574/014/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--126db1c9-aec8-5044-8874-ab6baef07e31", "name": "Delay Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1678", "url": "https://attack.mitre.org/techniques/T1678/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4", "name": "Impersonation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1684.001", "url": "https://attack.mitre.org/techniques/T1684/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d1196c34-0544-59d7-9b02-0cc96f514f2f", "name": "DCSync", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.006", "url": "https://attack.mitre.org/techniques/T1003/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "name": "Password Spraying", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.003", "url": "https://attack.mitre.org/techniques/T1110/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--af13d877-b7c3-5eae-b7f4-e44395f59397", "name": "Unsecured Credentials", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552", "url": "https://attack.mitre.org/techniques/T1552/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--43915db7-ed5a-5c4c-bda8-2c4b9c21d696", "name": "Kerberoasting", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1558.003", "url": "https://attack.mitre.org/techniques/T1558/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--76a0834e-5ada-528e-9a08-8c77779141b8", "name": "Steal or Forge Authentication Certificates", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1649", "url": "https://attack.mitre.org/techniques/T1649/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662", "name": "System Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1007", "url": "https://attack.mitre.org/techniques/T1007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1046", "url": "https://attack.mitre.org/techniques/T1046/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5", "name": "System Network Connections Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1049", "url": "https://attack.mitre.org/techniques/T1049/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609", "name": "Local Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.001", "url": "https://attack.mitre.org/techniques/T1087/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf", "name": "Domain Account", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1087.002", "url": "https://attack.mitre.org/techniques/T1087/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609", "name": "Remote Desktop Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.001", "url": "https://attack.mitre.org/techniques/T1021/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c5894c8b-3412-5bd2-890d-e8599e86517a", "name": "Internal Spearphishing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1534", "url": "https://attack.mitre.org/techniques/T1534/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4ecd42cd-e191-5e1d-9195-c6b622aff27a", "name": "RDP Hijacking", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1563.002", "url": "https://attack.mitre.org/techniques/T1563/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0d83c74-95e3-54c4-80bb-b14c0f983da7", "name": "Data from Network Shared Drive", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1039", "url": "https://attack.mitre.org/techniques/T1039/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6", "name": "Local Email Collection", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.001", "url": "https://attack.mitre.org/techniques/T1114/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--be508296-b698-51a6-a210-a4f2e272eda6", "name": "Data from Information Repositories", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213", "url": "https://attack.mitre.org/techniques/T1213/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6", "name": "Sharepoint", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.002", "url": "https://attack.mitre.org/techniques/T1213/002/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2c5c3c2e-68d5-5458-a5ef-d9acbe02f588", "name": "Messaging Applications", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.005", "url": "https://attack.mitre.org/techniques/T1213/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8915ecfc-b0f3-5b39-9edb-cbe3ddecb2fd", "name": "Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071", "url": "https://attack.mitre.org/techniques/T1071/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c8460-5319-5c9f-b034-f9796ba398d8", "name": "Modify or Spoof Tool UI", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685.003", "url": "https://attack.mitre.org/techniques/T1685/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--1cb37ec1-a133-5db1-b238-032690b5e1d2", "name": "CRASHPAD", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9057", "url": "https://attack.mitre.org/software/S9057/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--3deddf80-2211-5551-806e-cf110d19eb01", "name": "MiniBus", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9060", "url": "https://attack.mitre.org/software/S9060/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--a0ee20d7-3925-5484-8b81-2a089985ac02", "name": "DCSYNCER.SLICK", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9065", "url": "https://attack.mitre.org/software/S9065/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--4c0a4a59-c8b7-5b2a-af33-0a67e0c0ac9d", "name": "TRUSTTRAP", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9064", "url": "https://attack.mitre.org/software/S9064/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--079f6e18-ada4-5ba2-afdc-57eabf14f0ba", "name": "TWOSTROKE", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9067", "url": "https://attack.mitre.org/software/S9067/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--78457a02-475b-507a-96c6-e19689362f47", "name": "MiniFast", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9052", "url": "https://attack.mitre.org/software/S9052/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--6c788dfd-7500-5e67-8889-8bfe1eef20b6", "name": "MiniJunk", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9053", "url": "https://attack.mitre.org/software/S9053/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--393bf146-b08e-5458-990f-28213eedb363", "name": "LIGHTRAIL", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9061", "url": "https://attack.mitre.org/software/S9061/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--7b3f373b-0093-5a0f-a4ab-0da9b67614db", "name": "MiniBrowse", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9062", "url": "https://attack.mitre.org/software/S9062/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--867a05f1-f986-5cbd-88c5-3da0cfc21ebf", "name": "MiniBike", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9059", "url": "https://attack.mitre.org/software/S9059/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--2ef63d33-4ebd-5931-aa4e-26fec5f3ddf0", "name": "DEEPROOT", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9063", "url": "https://attack.mitre.org/software/S9063/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--54ab1ebc-5a13-5a7d-ba78-c272f82a05f9", "name": "SIGHTGRAB", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9058", "url": "https://attack.mitre.org/software/S9058/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--775c73e0-19bd-5d36-bdad-1624a369f261", "name": "POLLBLEND", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S9066", "url": "https://attack.mitre.org/software/S9066/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0bc977c4-b352-5c0c-87a7-2959171aabc0", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--68458f00-c09b-511b-95e8-fba0020056f1", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--1f9d7cd3-370e-5ab3-8870-d382c27a13f1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bdc057e0-b70d-50ae-88a4-872637ffac34", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e87ed7b0-48d6-50ee-bee5-60ec4c0db4c1", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8b43e841-bb29-589b-a274-705edc380e22", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--d205a6fa-1162-5237-bb35-b7e28ab0fc74" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a843b3da-e557-5a24-810a-6bb564a145c0", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bddeaf3f-9cad-588d-b54e-26149eb5a82a", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8c366088-fb12-56bc-ab03-e0a5cd4534d1", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8f19aebb-22c3-5f71-bf2d-4bfbc851f985", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--15abf442-a0ac-52a5-a3a8-5be11bcf75aa" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f6a84cdf-842a-55c8-92ca-bc362ea2b603", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--36038f5a-2114-5ab5-a9fe-7990a86ee2ce", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7ba515dc-b3df-5b2c-8e25-45be7751d709", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--b1043dec-3b68-530f-91e6-2fc36d306002" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9dd3e581-cc4f-52aa-becf-5cbfe2f93947", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--063833e0-c00b-5407-8894-bc2c69859010" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1cdc42bf-19ba-527f-a6ab-affd042c3e2e", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--36ee37f2-9509-5038-bdfa-156962c1bb1b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ec39dabd-e54e-53f8-9bcf-607a1ce3f69c", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--a51fd8ac-5b4b-598e-bd7a-3fae18063969" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--07d53768-c6ab-55e0-a433-9747ceccaaab", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--35b9453d-418b-5dbe-83ec-28bc8c77023e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8c2fea2b-61eb-5684-830c-4134743ef142", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--632f368a-23b9-5dff-95b1-82f4988533ca", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--742eb8ae-bfc4-538c-8ea2-4dc7aa389a92", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--549efc4f-2b4f-5fb4-ae09-5d4bb453399f", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--73e86f23-0585-57d3-8e10-06f394b4e217", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e11f1376-cd96-51e7-9f35-8f4ad3c3ee32", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--da846de2-ff50-5b6e-b1ec-3d7979191532", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--85c6554c-cc3e-5220-be56-09dcafe25253", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--cd33758f-3753-51cd-8cb5-c5cccfa32a61" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--87462bb4-63bc-5b7f-af79-19f907ae5aaf", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0c9d37a0-60df-56ca-9e2d-0c2a9f36a2bf", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--21280d2b-d731-5ff6-b010-29cc29b415fb", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--b5352aad-0392-588c-a845-03e485c68d4c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--679ff863-5587-566b-93d4-ec8d85fbfbed", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bc35ca84-dfd7-53f5-b675-e06fae0480b1", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5dca2209-cea7-530f-b8f8-b7065de57c34", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--703bd0c9-a591-5e45-b0d8-33380a6c6480", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--1e841714-1415-5ede-ba52-a008ffb19793" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2877b8b6-4d22-5553-8840-ce780197e8fe", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b2875fc6-5279-513d-94a4-ef9158e0000f", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9d4f86c6-acda-5226-b6ec-8a7b3f36951c", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--59f62fd5-3b3f-50e0-95d2-655230951028", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--268df97e-c736-5a70-b22d-0e25a8e23206" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1cefcc50-c018-522a-9be1-7c98fadf214a", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e3bb5d49-564b-59f2-a5e3-60447ec5bbea", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--295818ad-56ad-5966-b5ee-8951d1c2a41f", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3b6bba4c-9153-5538-87c6-771d60cbf040", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5e9d64ee-dbb3-55cc-884f-bfea82589d75", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--35145e78-ddb5-55c8-99bb-f0da17807b1b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--426e3650-a9f7-5f0e-9c7b-b7336ef6137a", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--126db1c9-aec8-5044-8874-ab6baef07e31" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--64dc2b96-e44e-5495-9ca4-24d8ad74b1be", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--5afe3ece-a974-5715-ad4f-ce8a2520e1c4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--acb7fcdd-f944-5dc5-b7e3-8fba8c86a342", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--d1196c34-0544-59d7-9b02-0cc96f514f2f" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d5c10b5f-fa28-5c8d-bca1-9193cdb5c56d", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--783899e3-4d60-5b76-b651-2e44b780d9e0", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--af13d877-b7c3-5eae-b7f4-e44395f59397" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--01e72219-da96-56b9-af75-fc1f11590af4", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--43915db7-ed5a-5c4c-bda8-2c4b9c21d696" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5d2beab9-817a-5f27-9f5c-ce422ca03989", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--76a0834e-5ada-528e-9a08-8c77779141b8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3b6e4b09-ffe3-59c3-b74b-6e95d2a36a18", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--120f6125-75f6-5eb8-9294-cb377d285662" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--26e4372f-cf72-556a-a5e1-3d34c4b81a1a", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--8a44a25f-7ace-567e-83f9-240b244761ce" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d4d56af8-4225-57ed-abb8-b953e900ca21", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--f83e565d-fdbf-5c07-a2bd-1c325c375ce5" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--139d1a8f-6f23-520d-b20f-11008d36260d", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--abe652a6-0426-589a-9443-d52e6f274f58", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--cef63e7c-92af-591d-a7bd-21561cfd9609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9d71d6a4-6b95-5cdd-af15-f077b33230ed", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--3dd23f2e-6937-595a-a69d-2d1863f80ccf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cece5e5c-4deb-5419-8aea-f04ef7e72e5e", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--a521d987-56a7-58c5-b5c6-1185fe4b4609" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--970c9d7e-2411-5f6d-b42c-fdfec23094a6", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--198685d8-a7a6-5de7-8ca8-91b7c236d89b", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--c5894c8b-3412-5bd2-890d-e8599e86517a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--0e3775a3-f3a6-5427-a3e5-c7d630257405", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--4ecd42cd-e191-5e1d-9195-c6b622aff27a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cd8c4ac4-58de-5b86-92fb-e8534e0c1c70", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--a0d83c74-95e3-54c4-80bb-b14c0f983da7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a7aaf7fc-24c0-5338-84fa-5a0f4337a72e", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fa76e64c-776c-55fd-85e4-6b93dcac4c1e", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--be508296-b698-51a6-a210-a4f2e272eda6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--7eedebee-3819-56cb-a148-77c2705ab6ec", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--a6988f8a-90b2-594a-85f5-6651769ab7f6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f5314e7a-5ea9-53d7-a2fd-c69748439143", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--2c5c3c2e-68d5-5458-a5ef-d9acbe02f588" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3d8bad53-0425-55ed-8775-30f88109b7cd", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--8915ecfc-b0f3-5b39-9edb-cbe3ddecb2fd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--908a608e-6152-5ee1-89fc-dfdebdc0bc9c", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9de638cf-7029-5482-abfa-a8495f549bb4", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "attack-pattern--931c8460-5319-5c9f-b034-f9796ba398d8" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--690c9fa8-84fa-569a-9f10-ab3c2a8b7573", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--1cb37ec1-a133-5db1-b238-032690b5e1d2" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--1ae16f41-d773-5659-be83-95a76177a32f", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--3deddf80-2211-5551-806e-cf110d19eb01" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--49bd1fd8-72e3-58e5-b16a-aee459f50b36", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--a0ee20d7-3925-5484-8b81-2a089985ac02" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ed4fc07b-96e6-50e8-aef0-c00cb9b4c84f", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--4c0a4a59-c8b7-5b2a-af33-0a67e0c0ac9d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--52f673b6-856b-5611-8507-910ad9c632bf", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--079f6e18-ada4-5ba2-afdc-57eabf14f0ba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--f14e0a57-8756-5417-b781-1f12f68f55dd", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--78457a02-475b-507a-96c6-e19689362f47" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c64b51a9-f148-56c0-9279-f96aa2554250", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--6c788dfd-7500-5e67-8889-8bfe1eef20b6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--cecb14c0-dc03-52ae-8a3f-c9329194a839", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--393bf146-b08e-5458-990f-28213eedb363" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b36ea6de-ed36-59b1-819f-f5637c7d1cd7", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--7b3f373b-0093-5a0f-a4ab-0da9b67614db" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--72bff9d1-dbbf-5f38-a427-4101c4fb2899", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--867a05f1-f986-5cbd-88c5-3da0cfc21ebf" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--785d1e21-49aa-5572-b152-9050be58e0db", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--2ef63d33-4ebd-5931-aa4e-26fec5f3ddf0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b0019549-d2f0-59e5-9adb-785b3da8b9f8", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--54ab1ebc-5a13-5a7d-ba78-c272f82a05f9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-18T21:35:12.981Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b68a9e03-9fc6-58c3-adb3-f1064eef2da2", "relationship_type": "uses", "source_ref": "intrusion-set--9891852b-576e-5855-a39f-4b01b6d5ad4f", "target_ref": "malware--775c73e0-19bd-5d36-bdad-1624a369f261" } ] }