{"type":"bundle","id":"bundle--73a3246d-2398-56d3-b3ca-3f3f2cc09193","objects":[{"type":"intrusion-set","id":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"APT27","aliases":["Group 35","BRONZE UNION","Earth Smilodon","Iron Tiger","ZipToken","LuckyMouse","Threat Group 3390","EMISSARY PANDA","Silk Typhoon","G0027","Red Sylvan","TG-3390"],"first_seen":"2010-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt27"},{"source_name":"mitre-attack","external_id":"G0027","url":"https://attack.mitre.org/groups/G0027/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--cd8b6cac-2d56-5f5e-8105-6c8e4fc88685","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--eb90f797-9177-584d-882a-793e66ca6a32","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"LSA Secrets","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.004","url":"https://attack.mitre.org/techniques/T1003/004"}]},{"type":"relationship","id":"relationship--8242de0e-f4ed-565c-a456-8a424d8531b7","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--a4486278-918d-5ac5-b60d-e67136a54c86","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--b205a35f-117e-5cda-8fdf-8f3a850c7518","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--77095f4c-944c-56b3-866b-b89116a8086b","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Password Managers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.005","url":"https://attack.mitre.org/techniques/T1555/005"}]},{"type":"relationship","id":"relationship--cd65e6e6-7fb8-5b98-bdee-ae36a1015119","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58"},{"type":"attack-pattern","id":"attack-pattern--6476deb6-37b2-5a6a-8c17-8ea4bbac68f2","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Archive via Library","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.002","url":"https://attack.mitre.org/techniques/T1560/002"}]},{"type":"relationship","id":"relationship--c8b4bd67-0fce-5caf-9440-240542b79869","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--6476deb6-37b2-5a6a-8c17-8ea4bbac68f2"},{"type":"attack-pattern","id":"attack-pattern--4a2ebb16-fd07-501b-988e-a8f0c19b6d03","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Windows Remote Management","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.006","url":"https://attack.mitre.org/techniques/T1021/006"}]},{"type":"relationship","id":"relationship--9ee38adf-b0ed-540e-841c-b03a79f84a6a","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--4a2ebb16-fd07-501b-988e-a8f0c19b6d03"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--88d9c79e-94dc-56dd-bd3c-e256ec0d7d07","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--0a6cb759-9e2c-506e-b8c6-1c6d11d90285","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--af2baa72-7611-5dfd-a4fa-e81793a2eaa9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Network Share Connection Removal","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.005","url":"https://attack.mitre.org/techniques/T1070/005"}]},{"type":"relationship","id":"relationship--8c6fa645-d9fe-513b-b2ed-8c46699665b4","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--af2baa72-7611-5dfd-a4fa-e81793a2eaa9"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--d5326526-bab4-5e8d-821f-8dbf96515ed9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--242bc773-3f5c-541a-98a5-f3fd30585c67","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Data Transfer Size Limits","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1030","url":"https://attack.mitre.org/techniques/T1030"}]},{"type":"relationship","id":"relationship--49ca5288-3996-5ac0-b0dc-1b200e6d0dde","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161"},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--2bd9e261-614f-556b-be28-a45107381832","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--6496c9f8-ed8d-5636-8db2-0b01da187180","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--2cb0457d-b831-583b-bc3d-c10f8b0f84fd","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--7b9a72b4-186d-55ba-96c4-f981b3efe351","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--b7552a6a-9c12-5d0b-b37f-9082d915061c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--52c7e47b-be40-519e-8f4f-8e18377515ad","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Process Hollowing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.012","url":"https://attack.mitre.org/techniques/T1055/012"}]},{"type":"relationship","id":"relationship--8ba1bb3d-38e0-549e-9906-25191c3c3977","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--52c7e47b-be40-519e-8f4f-8e18377515ad"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--e5e78dbc-f574-5990-a0ec-cc5addb4e9da","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--3eca2982-85ad-5da0-89b1-e1108c4e4c4e","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--f92e800e-649d-5693-9bb1-6e575bad02e0","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--456845da-3168-5007-85bf-c3ac39ee7f81","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"At","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.002","url":"https://attack.mitre.org/techniques/T1053/002"}]},{"type":"relationship","id":"relationship--2b8a076e-24b6-54b2-a148-99c492ea2254","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--9479f52a-db64-5e08-8898-216b0719bc17","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--8abd4184-efc9-534e-ba5a-5b8e8c2a7c9f","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--ab223962-4810-59c2-bcd0-deeae336ef05","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--91cbc190-32df-5a45-879e-32b188526b85","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--dd9d0e06-9b4b-52cb-a10d-af83072a4d22","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Compromise Software Supply Chain","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195.002","url":"https://attack.mitre.org/techniques/T1195/002"}]},{"type":"relationship","id":"relationship--57ae25f6-e2e8-5da8-a6ed-5f907d8d1d25","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--4ea9bd61-004f-588b-b684-46a265977e16","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--dc82a967-a5ed-5181-99cd-15e3c38747f9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--94ca35c0-0d44-52a5-9ca2-8026b5cda164","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--9bce7e50-ad19-5d17-868a-2037b0c1977f","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Compression","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.015","url":"https://attack.mitre.org/techniques/T1027/015"}]},{"type":"relationship","id":"relationship--ad2087bc-a4eb-5f06-a9ef-8ec88e4f98de","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--b418dfa7-d37b-547a-8c71-2f941efdcabd","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--339dc5ad-13e6-5b5f-9981-90078711bd54","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--5157fba8-1e6d-5413-a2dd-e52cb24e5092","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"uses","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--72b29374-7e0f-5f98-9dbc-afd125019e04","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--79cb9c04-f50d-549d-babc-91d41c24b770","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--90f012e4-86a5-573f-bac6-f55120cc463d","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--257954f7-c881-58f2-8041-ed998bdfcb99","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--9b4c5e90-be79-5d56-ba7b-e30d8b1c0036","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--41281c48-bfe0-53a2-a394-7ead9c0a8a3e","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--7657ba9c-ec19-5be1-8dce-bdeda83572ca","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--a3899a67-11b5-5900-abd3-a69297865505","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--2b0ce4c4-4e94-5d1b-bde4-5bbb8fa50de3","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--906498e9-7d5b-540b-ba57-2b547a97ccba","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Kuwait","country":"KW","region":"asia"},{"type":"relationship","id":"relationship--4fd0f90e-c1ef-52c2-817f-ad1d6caffb6c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--ac1a34e8-d4cf-5bae-a4ce-6084d6ecd779","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--60eb2fda-8064-52e0-b219-899f2ea9945c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--3cd79224-9615-55ee-8547-35f3201b8c4c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Qatar","country":"QA","region":"asia"},{"type":"relationship","id":"relationship--a9d5232d-c3c3-5472-9cbf-e5f7b31c3b9c","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--3cd79224-9615-55ee-8547-35f3201b8c4c"},{"type":"location","id":"location--48c0566b-263f-5cdb-b529-4f2715353a59","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Serbia","country":"RS","region":"europe"},{"type":"relationship","id":"relationship--60baf042-10bd-56a1-8465-4cc4bea637b9","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--48c0566b-263f-5cdb-b529-4f2715353a59"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--986983b9-e5e9-58eb-a192-7f355e286dea","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--883c16bf-e767-5e36-800f-37b41a473017","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--bc5494db-2f58-5987-8e7d-17125f4b4eba","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Tunisia","country":"TN","region":"africa"},{"type":"relationship","id":"relationship--e1be6b3d-2be7-5a9b-9c91-1ff814304f27","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--0f0c7a62-63ef-563b-8a6e-bd065df55c76","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--abcf8c05-5e5b-52f9-8d06-78da2495c3f8","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--58e5f2dd-9554-57f6-9f1e-f3cb179f69ca","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--ab87c96a-3bac-5486-8732-dd2fe93182e1","spec_version":"2.1","created":"2026-05-20T09:50:14.015881+00:00","modified":"2026-07-28T19:42:10.449+00:00","relationship_type":"targets","source_ref":"intrusion-set--f0750f5c-e496-5e1f-a112-6f3bdab37907","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}