{ "type": "bundle", "id": "bundle--761e264f-1e6e-5dfa-9a9a-deb4d966f993", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--c1b401e5-a927-598d-859c-fc757d058154", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-09-07T00:00:00.000Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "name": "skopnix", "identity_class": "organization", "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.", "contact_information": "https://skopnix.com" }, { "type": "intrusion-set", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "name": "UNC3886", "aliases": [ "UNC3886" ], "description": "UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating systems.", "external_references": [ { "source_name": "mitre-attack", "external_id": "G1048", "url": "https://attack.mitre.org/groups/G1048/" }, { "source_name": "skopnix", "external_id": "unc3886", "url": "https://skopnix.com/actors/unc3886" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass" }, { "source_name": "mandiant.com", "url": "https://www.mandiant.com/resources/blog/vmware-detection-containment-hardening" }, { "source_name": "attack.mitre.org", "url": "https://attack.mitre.org/groups/G1048" }, { "source_name": "cloud.google.com", "url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--b029bb82-521a-502a-af34-b0df33d9df9c", "name": "Search Threat Vendor Data", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1681", "url": "https://attack.mitre.org/techniques/T1681/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5b07cc88-411d-5f39-9102-0540a0b55660", "name": "Exploits", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.004", "url": "https://attack.mitre.org/techniques/T1587/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cd473b95-350a-5960-8aa3-0310582d7e8e", "name": "Malware", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.001", "url": "https://attack.mitre.org/techniques/T1588/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--089a9770-8795-59af-a756-c25c11a4d7b1", "name": "Digital Certificates", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.004", "url": "https://attack.mitre.org/techniques/T1588/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "resource-development" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.003", "url": "https://attack.mitre.org/techniques/T1059/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0968668b-c601-577e-b6ab-743ce54e4499", "name": "Unix Shell", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.004", "url": "https://attack.mitre.org/techniques/T1059/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.006", "url": "https://attack.mitre.org/techniques/T1059/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d377f579-4365-5e7e-9cf9-953add6e6647", "name": "Hypervisor CLI", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.012", "url": "https://attack.mitre.org/techniques/T1059/012/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d", "name": "Exploitation for Client Execution", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1203", "url": "https://attack.mitre.org/techniques/T1203/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--efa68348-271b-55eb-b979-01eaf6be76eb", "name": "ESXi Administration Command", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1675", "url": "https://attack.mitre.org/techniques/T1675/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cfada88d-bc4f-5985-8297-1132075f0497", "name": "Boot or Logon Initialization Scripts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1037", "url": "https://attack.mitre.org/techniques/T1037/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--8a13c057-07ef-582b-a900-b114106b3f2a", "name": "RC Scripts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1037.004", "url": "https://attack.mitre.org/techniques/T1037/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2c57b1c4-f49c-52cb-bb37-b08e45a5eaa1", "name": "vSphere Installation Bundles", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.006", "url": "https://attack.mitre.org/techniques/T1505/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--355d8f01-62d4-5590-b2d9-7c03af032957", "name": "Compromise Host Software Binary", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1554", "url": "https://attack.mitre.org/techniques/T1554/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--4cffb1fe-9891-5809-a618-73c51b6ec5d1", "name": "Abuse Elevation Control Mechanism", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1548", "url": "https://attack.mitre.org/techniques/T1548/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--1934438a-00cf-5044-a56f-3193c0a0c42e", "name": "Rootkit", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1014", "url": "https://attack.mitre.org/techniques/T1014/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--2c558883-337c-5465-9341-b2ff3d98faf4", "name": "Indicator Removal from Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027.005", "url": "https://attack.mitre.org/techniques/T1027/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48", "name": "Masquerade Task or Service", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.004", "url": "https://attack.mitre.org/techniques/T1036/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208", "name": "File Deletion", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.004", "url": "https://attack.mitre.org/techniques/T1070/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c", "name": "Timestomp", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.006", "url": "https://attack.mitre.org/techniques/T1070/006/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--268df97e-c736-5a70-b22d-0e25a8e23206", "name": "Clear Network Connection History and Configurations", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070.007", "url": "https://attack.mitre.org/techniques/T1070/007/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "name": "Valid Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--56b84968-c4a2-5fe8-96d7-834849cae7ba", "name": "Default Accounts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.001", "url": "https://attack.mitre.org/techniques/T1078/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--9c40be11-17cc-52b7-9897-f6b5d33be8cb", "name": "Traffic Signaling", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1205", "url": "https://attack.mitre.org/techniques/T1205/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--5d73fcda-34f8-53cb-94e7-4c67d2e6ca5d", "name": "Port Knocking", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1205.001", "url": "https://attack.mitre.org/techniques/T1205/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a", "name": "Rundll32", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1218.011", "url": "https://attack.mitre.org/techniques/T1218/011/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6c52e39-4ba0-57c5-8718-571b666e8618", "name": "Ignore Process Interrupts", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1564.011", "url": "https://attack.mitre.org/techniques/T1564/011/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "stealth" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc", "name": "LSASS Memory", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1003.001", "url": "https://attack.mitre.org/techniques/T1003/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--27c66f9b-891a-51df-ab50-b378ff2ed239", "name": "Network Sniffing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1040", "url": "https://attack.mitre.org/techniques/T1040/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a165ec03-e097-52fc-b4b9-cba05cc92b04", "name": "Exploitation for Credential Access", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1212", "url": "https://attack.mitre.org/techniques/T1212/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e819d2da-777b-5885-8904-e9828a685d31", "name": "Password Managers", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555.005", "url": "https://attack.mitre.org/techniques/T1555/005/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1057", "url": "https://attack.mitre.org/techniques/T1057/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49", "name": "System Time Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1124", "url": "https://attack.mitre.org/techniques/T1124/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--cf68bae6-71ce-5400-a196-fef6caa40eb0", "name": "Virtual Machine Discovery", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1673", "url": "https://attack.mitre.org/techniques/T1673/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--3091eab7-075d-55ec-8be6-f5fefb159a4b", "name": "SSH", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.004", "url": "https://attack.mitre.org/techniques/T1021/004/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03", "name": "Lateral Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1570", "url": "https://attack.mitre.org/techniques/T1570/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9", "name": "Local Data Staging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1074.001", "url": "https://attack.mitre.org/techniques/T1074/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9", "name": "Archive via Utility", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.001", "url": "https://attack.mitre.org/techniques/T1560/001/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b", "name": "Archive via Custom Method", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.003", "url": "https://attack.mitre.org/techniques/T1560/003/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--ac5f8e3e-6b86-5398-b5c9-c62e39a6462d", "name": "Fallback Channels", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1008", "url": "https://attack.mitre.org/techniques/T1008/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403", "name": "Non-Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1095", "url": "https://attack.mitre.org/techniques/T1095/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1685", "url": "https://attack.mitre.org/techniques/T1685/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57", "name": "Disable or Modify System Firewall", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1686", "url": "https://attack.mitre.org/techniques/T1686/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "attack-pattern--043a38ec-4a65-5950-8e45-e6ebb3378c0c", "name": "Prevent Command History Logging", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1690", "url": "https://attack.mitre.org/techniques/T1690/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-impairment" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--6e67b0b8-f473-5cdb-ba11-3745e3f6c5cd", "name": "MOPSLED", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1221", "url": "https://attack.mitre.org/software/S1221/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--fbaf7f8d-57b4-5470-a00f-52c3afcd5ce4", "name": "VIRTUALPIE", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1218", "url": "https://attack.mitre.org/software/S1218/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--9c25736a-5f0d-510a-91a7-6c11d1d2f4f6", "name": "CASTLETAP", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1224", "url": "https://attack.mitre.org/software/S1224/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--c47b0415-ce77-5086-ad0a-6ff25aba6f76", "name": "THINCRUST", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1223", "url": "https://attack.mitre.org/software/S1223/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--31485a16-0fa3-588f-a80d-9e32af4ca329", "name": "VIRTUALPITA", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1217", "url": "https://attack.mitre.org/software/S1217/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--d96d0047-9578-554e-8c2c-f3ef810a40ad", "name": "REPTILE", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1219", "url": "https://attack.mitre.org/software/S1219/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--e021c763-00f0-5a29-9208-5ce8433de0c3", "name": "MEDUSA", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1220", "url": "https://attack.mitre.org/software/S1220/" } ] }, { "type": "malware", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "malware--74dd805a-1907-50e5-aaef-5fe6fc687fb4", "name": "RIFLESPINE", "is_family": true, "external_references": [ { "source_name": "mitre-attack", "external_id": "S1222", "url": "https://attack.mitre.org/software/S1222/" } ] }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4e8823d6-ebcc-5d49-b176-46c73d095d15", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--b029bb82-521a-502a-af34-b0df33d9df9c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ed43a693-e9e9-537a-ae6c-274d023f8915", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--13139403-95a1-5a2e-9ada-371ccee4fc4b", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--5b07cc88-411d-5f39-9102-0540a0b55660" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--af01639b-5dab-551b-9017-2cefe20fd146", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--cd473b95-350a-5960-8aa3-0310582d7e8e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--44a3dbea-2bda-5927-8e96-2c8968c765e3", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--089a9770-8795-59af-a756-c25c11a4d7b1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5b8f739d-5a8f-5354-bb38-b8830b37d4d3", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--235ca690-b3c0-5e00-b8a5-37e62a307602", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9710095a-29b3-5f48-9523-61c427085463", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5e5bb836-c2f7-5544-9acc-029f315fef4e", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--0968668b-c601-577e-b6ab-743ce54e4499" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b82251fd-c427-5dda-a741-5dd70f729868", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6366dd45-7768-5770-84c7-3a7a24b77ea5", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--d377f579-4365-5e7e-9cf9-953add6e6647" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--974d92d5-d1e2-5e39-b477-c9d5c3d37a7c", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fc11bcd4-5227-5b13-93c9-f9de4cc238d0", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--efa68348-271b-55eb-b979-01eaf6be76eb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a6b352c5-0305-5e37-8e08-d3c6d660fd47", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--cfada88d-bc4f-5985-8297-1132075f0497" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--e6716061-326d-5daa-bbfa-9f85cce836e8", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--8a13c057-07ef-582b-a900-b114106b3f2a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d32f0483-7977-5b79-b6bb-43212d26d150", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--2c57b1c4-f49c-52cb-bb37-b08e45a5eaa1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--60a79e69-95c0-5cdc-9c6d-bf88d29e0b39", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--355d8f01-62d4-5590-b2d9-7c03af032957" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3ab5184b-2c07-56b3-87f6-43d86693d28e", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--9b2049ef-3148-56f7-b722-dcb3c1922381", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--4cffb1fe-9891-5809-a618-73c51b6ec5d1" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--320cc9ec-7075-5923-9018-4be869d6216c", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--1934438a-00cf-5044-a56f-3193c0a0c42e" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--713772db-5035-5e23-84fd-f656bbfb12ac", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--2c558883-337c-5465-9341-b2ff3d98faf4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a8a8a9f7-94ec-5858-9c93-130f864d6bb6", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a9496ec0-b380-5b8d-b57b-b67ebb89572b", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--59c10059-9244-5d7a-8558-d5bb695d011f", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--0913d299-853e-5e6d-9061-c0f1af915f2c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--43680ba4-9a34-5354-954f-82e8ab0ec188", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--268df97e-c736-5a70-b22d-0e25a8e23206" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--20348eaa-384c-5da3-97b9-94b5c89effc8", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--8ae8f007-9ff1-5bbe-9947-fb1676890b76", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--56b84968-c4a2-5fe8-96d7-834849cae7ba" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c1b4edc6-1028-50b9-a251-4f07d6d66097", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--9c40be11-17cc-52b7-9897-f6b5d33be8cb" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--97f303a3-0100-5590-a47a-d1769cf8bd66", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--5d73fcda-34f8-53cb-94e7-4c67d2e6ca5d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--84524199-3966-5e46-a15e-a17892883e8f", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--4cb82b71-7092-5e93-bed4-43a9fb22232b", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--e6c52e39-4ba0-57c5-8718-571b666e8618" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fdfeae6c-028e-53af-8569-254fdbe49355", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--20a0f066-d800-5465-a6d8-921ac988a07c", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--27c66f9b-891a-51df-ab50-b378ff2ed239" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6c897f28-609b-576d-b952-3a9526f12437", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--a165ec03-e097-52fc-b4b9-cba05cc92b04" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--5a7da7d7-66a7-50c6-84b4-9e6765f5adf5", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--e819d2da-777b-5885-8904-e9828a685d31" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--b787e76c-4f34-5c8a-91d3-dc2dd32c211d", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--a0df756b-eb37-587c-a8e1-16e7b1f30dc0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--41bd79ed-f848-5123-aad2-c0c7ccedcfeb", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6d3093aa-0acf-52f2-958e-132c00afa523", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--3bd3e90b-3dcb-5f7d-9ad7-90c2975a4855", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--cf68bae6-71ce-5400-a196-fef6caa40eb0" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--ba553432-b9fb-58f3-b23c-b2915d1d762a", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--3091eab7-075d-55ec-8be6-f5fefb159a4b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--403d9863-659e-568f-9d06-a3beb11b87a7", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--12bc2a37-c1bf-56fe-a992-bead8afeeb03" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--67321122-4ad1-57c3-a9a1-9d94b293628c", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--459c1ace-e45f-57ac-8239-f29487282ce9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--430d4368-aab8-5884-8415-50ab30385abf", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--e6e2b517-832b-5feb-a9e0-a147b8ba20c9" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--bb4141b7-c2a0-54b1-ae76-e1be1ec8bbea", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--f6911a3d-5bcb-5f1f-b147-b143c5f95c6b" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6af34b09-4875-524a-8bcb-853a76ee1af5", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--ac5f8e3e-6b86-5398-b5c9-c62e39a6462d" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--d8211e9c-e825-5e3d-a970-f86125268483", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--dcc8aad3-2649-5b55-b2b6-bef87a7d1403" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--fc93b610-0382-55f3-8d9a-8641113c6762", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--89610a4e-c478-54a9-b9f3-a1ba1d06fc48" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c58cf97a-f66d-5398-8d1d-9b383ced685b", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--2347eec3-d3c1-55a5-9d35-0abadf2febe2", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "attack-pattern--043a38ec-4a65-5950-8e45-e6ebb3378c0c" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--28883bf1-5471-55c7-a322-0dbbc4be8007", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--6e67b0b8-f473-5cdb-ba11-3745e3f6c5cd" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--55ce8d4b-6212-5c72-ac2f-c783f94ecf0f", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--fbaf7f8d-57b4-5470-a00f-52c3afcd5ce4" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--a7907e74-fe68-591d-bf8a-33e799a8116a", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--9c25736a-5f0d-510a-91a7-6c11d1d2f4f6" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--6f5c6652-80fa-58b5-838e-13989a2f3675", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--c47b0415-ce77-5086-ad0a-6ff25aba6f76" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c86c4b75-79c7-5800-b14a-b3a100f6f994", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--31485a16-0fa3-588f-a80d-9e32af4ca329" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--071409ba-0d5c-512f-9316-0594c3a12559", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--d96d0047-9578-554e-8c2c-f3ef810a40ad" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c14da484-f324-5a26-aeb8-dbcbcaa3f1dc", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--e021c763-00f0-5a29-9208-5ce8433de0c3" }, { "type": "relationship", "spec_version": "2.1", "created": "2026-09-07T00:00:00.000Z", "modified": "2026-10-06T13:27:36.797Z", "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "id": "relationship--c0a75322-970e-5697-a087-c4e40e0213b6", "relationship_type": "uses", "source_ref": "intrusion-set--df1244ce-01ef-5b3f-aecb-bb016b926e4c", "target_ref": "malware--74dd805a-1907-50e5-aaef-5fe6fc687fb4" } ] }