{"type":"bundle","id":"bundle--23d16393-db50-502f-acf8-1988a9cdbd0d","objects":[{"type":"intrusion-set","id":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"APT28","description":"Russian military intelligence cyber-espionage group attributed to GRU Unit 26165.","aliases":["SNAKEMACKEREL","Tsar Team","Pawn Storm","TG-4127","STRONTIUM","Swallowtail","ITG05","ATK5","Group 74","Grizzly Steppe","Sednit Group","Forest Blizzard","FANCY BEAR","Sednit","Sofacy","G0007","TA422","Blue Athena","Iron Twilight"],"first_seen":"2007-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt28"},{"source_name":"mitre-attack","external_id":"G0007","url":"https://attack.mitre.org/groups/G0007/"}],"labels":["nation-state","dis","esp"]},{"type":"attack-pattern","id":"attack-pattern--0782cae9-183d-51b4-b87a-f5bbd2b9d4f1","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Junk Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1001.001","url":"https://attack.mitre.org/techniques/T1001/001"}]},{"type":"relationship","id":"relationship--a33415b4-687a-577c-80ac-00f3123a3ef6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--0782cae9-183d-51b4-b87a-f5bbd2b9d4f1"},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--d16d4acd-e30e-54bc-b9ca-a8e743e9ab9c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--64781470-3499-5922-b518-a036888fd16c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--a4ab6c35-a5a2-56e6-9372-aa385b919fe7","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--acee6f50-d55d-56f5-a8db-f6041ce812cc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"LSA Secrets","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.004","url":"https://attack.mitre.org/techniques/T1003/004"}]},{"type":"relationship","id":"relationship--e3cc3e86-f9f3-54dc-9175-97167cd807c3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--642a5c6c-b5e9-5c89-a71d-ca8d21d981db","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Rootkit","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1014","url":"https://attack.mitre.org/techniques/T1014"}]},{"type":"relationship","id":"relationship--159f6e77-83dd-52b8-84f5-c03c595d0175","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--e9ce9d56-b16f-5612-87d6-01a6b3903a7d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Data from Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1025","url":"https://attack.mitre.org/techniques/T1025"}]},{"type":"relationship","id":"relationship--248a1d65-369a-586d-93de-f17b728ee9ab","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297"},{"type":"attack-pattern","id":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Data Transfer Size Limits","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1030","url":"https://attack.mitre.org/techniques/T1030"}]},{"type":"relationship","id":"relationship--4741d2e0-25e5-592d-8ecb-9c0e7f78796d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--7f628c01-83dd-5230-9e60-e0ea79461bfc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--456ab725-cf79-5105-9f0b-05b3c691fb94","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Boot or Logon Initialization Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037","url":"https://attack.mitre.org/techniques/T1037"}]},{"type":"relationship","id":"relationship--752ae933-0c88-55b1-a634-d1dbc3bde605","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6"},{"type":"attack-pattern","id":"attack-pattern--54f12baf-b884-5f8e-bd39-75263680c402","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Logon Script (Windows)","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037.001","url":"https://attack.mitre.org/techniques/T1037/001"}]},{"type":"relationship","id":"relationship--a35f9003-6c43-5be0-b4f6-280c9212104a","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--54f12baf-b884-5f8e-bd39-75263680c402"},{"type":"attack-pattern","id":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Data from Network Shared Drive","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1039","url":"https://attack.mitre.org/techniques/T1039"}]},{"type":"relationship","id":"relationship--e9a6f4fa-6a38-59bc-8b45-b4fbe4cb63fc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986"},{"type":"attack-pattern","id":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Network Sniffing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1040","url":"https://attack.mitre.org/techniques/T1040"}]},{"type":"relationship","id":"relationship--93c11952-46dc-5ec5-a1ba-a4a4f3799133","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--687c4241-0b5f-532a-af26-ac534414d905","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--143f4dba-8a8a-5a49-85d4-d2c5dcd4b053","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--654644f1-3788-5c02-bc13-e2925783bd85","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--d952f2ae-961b-5831-836b-3701fdac2d07","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--39e53027-3db7-5a7e-b953-254153905848","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Cloud API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.009","url":"https://attack.mitre.org/techniques/T1059/009"}]},{"type":"relationship","id":"relationship--b40c59f3-c93a-55de-ba7a-ee45eb030ff9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--39e53027-3db7-5a7e-b953-254153905848"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--18fa6427-f794-50e9-88e2-b7c7c266bf09","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--66caa893-545a-542d-a422-7d41d77c3b71","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--c6cefc0b-c1d4-5a6d-a9bc-8172d53ddd4b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Mail Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.003","url":"https://attack.mitre.org/techniques/T1071/003"}]},{"type":"relationship","id":"relationship--3ddca7b4-1ed4-5fe9-9572-9f437a9a6048","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--6b23b18f-04b2-58b8-b58d-0820151f1579","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Cloud Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.004","url":"https://attack.mitre.org/techniques/T1078/004"}]},{"type":"relationship","id":"relationship--3aca3cab-aa44-5318-844f-28c6eecf06bc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--ccc948e4-f86c-56bd-9cd8-971e05767576","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--18320008-debb-5be3-b143-8c5d5cb144bc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Replication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1091","url":"https://attack.mitre.org/techniques/T1091"}]},{"type":"relationship","id":"relationship--4fb2d0a7-90a4-5638-9ad9-9acf119d1e83","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b"},{"type":"attack-pattern","id":"attack-pattern--229dca6c-ecb2-5494-89c5-8d72c3238ede","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Communication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1092","url":"https://attack.mitre.org/techniques/T1092"}]},{"type":"relationship","id":"relationship--d6e10e8c-3e26-5490-adf6-8843d848b458","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--229dca6c-ecb2-5494-89c5-8d72c3238ede"},{"type":"attack-pattern","id":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Additional Email Delegate Permissions","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098.002","url":"https://attack.mitre.org/techniques/T1098/002"}]},{"type":"relationship","id":"relationship--e896f3cc-cabd-5578-8d22-9f6321b3ae92","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--01507a11-ef50-5131-84dc-e83f38f59d14","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--6dabfea4-7cee-5141-8ecf-9363f471161b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--c0cc038a-29ad-5a60-9d8d-9623fed6a24d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--22ec45b2-24c3-5417-81c6-0e5f253acad8","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--168a1a84-8fde-56f9-8c75-c89637dd6449","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--e8883875-7e64-5bb9-b557-9331a9229754","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--8c3229c8-7969-5fce-be6a-b05f6fd69438","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"External Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1133","url":"https://attack.mitre.org/techniques/T1133"}]},{"type":"relationship","id":"relationship--a7a59124-fb5a-5b9b-984d-aa96448fbbf3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d"},{"type":"attack-pattern","id":"attack-pattern--35703771-b2dd-5862-998f-8d28655b119c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Office Test","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137.002","url":"https://attack.mitre.org/techniques/T1137/002"}]},{"type":"relationship","id":"relationship--c421796d-7f6d-5548-b294-de1f8fcee640","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--35703771-b2dd-5862-998f-8d28655b119c"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--76454424-2bf8-58af-9a55-df23af512702","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--3cf83cdc-6250-54e2-b2e6-f303d1665337","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--ce6f6559-adf6-5816-9990-3b31d234857b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--0e1337a6-c990-5341-92f7-31603a352166","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--dd67ffc5-168e-5c66-ad09-170aca5e2edc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--9b2e4ca6-e303-5444-a874-c03d3f37a114","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--e2554373-3763-5daa-864d-7a6a21441d47","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--e10ddcdd-a137-5d5b-84aa-dda0693faad9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exploitation for Stealth","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1211","url":"https://attack.mitre.org/techniques/T1211"}]},{"type":"relationship","id":"relationship--a70fe162-fe2f-5a4b-a116-85fdb854b5d1","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--e10ddcdd-a137-5d5b-84aa-dda0693faad9"},{"type":"attack-pattern","id":"attack-pattern--15f34006-1ae3-543e-adca-25bd81176b74","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Data from Information Repositories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1213","url":"https://attack.mitre.org/techniques/T1213"}]},{"type":"relationship","id":"relationship--548648b7-c420-5d26-9afb-9dbeecf85917","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--15f34006-1ae3-543e-adca-25bd81176b74"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--246e9d7d-09da-5f3d-895d-d6126d870c35","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Template Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1221","url":"https://attack.mitre.org/techniques/T1221"}]},{"type":"relationship","id":"relationship--794b95e1-3a34-5933-94f8-7dc254ac98e9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58"},{"type":"attack-pattern","id":"attack-pattern--8a89d06e-4cab-537b-abbc-5d80242a05a6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Network Denial of Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1498","url":"https://attack.mitre.org/techniques/T1498"}]},{"type":"relationship","id":"relationship--d3144565-d2d5-5e64-a1b5-a53e6e9b8c39","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--8a89d06e-4cab-537b-abbc-5d80242a05a6"},{"type":"attack-pattern","id":"attack-pattern--d4ea0b7e-fb73-5b3b-a10a-b196577fff20","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Steal Application Access Token","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1528","url":"https://attack.mitre.org/techniques/T1528"}]},{"type":"relationship","id":"relationship--779fd99d-dbdd-54d6-a6e7-9cceda2ad2e1","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--d4ea0b7e-fb73-5b3b-a10a-b196577fff20"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--d2f95cb4-1c2b-58a1-afa7-af5b5d8cffac","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--90406f06-a0eb-55f1-8c2b-331ca9995a3f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Application Access Token","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.001","url":"https://attack.mitre.org/techniques/T1550/001"}]},{"type":"relationship","id":"relationship--11818bf1-9498-5c12-9fe8-7c703616beed","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--90406f06-a0eb-55f1-8c2b-331ca9995a3f"},{"type":"attack-pattern","id":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Pass the Hash","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.002","url":"https://attack.mitre.org/techniques/T1550/002"}]},{"type":"relationship","id":"relationship--ecdf4d90-7043-5098-b48f-aa9a4c0beddd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e"},{"type":"attack-pattern","id":"attack-pattern--62cf33f1-0c6d-50fe-aeaf-0a2052ec6ac6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Evil Twin","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1557.004","url":"https://attack.mitre.org/techniques/T1557/004"}]},{"type":"relationship","id":"relationship--400e1578-7aa4-596a-b60d-84feac416762","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--62cf33f1-0c6d-50fe-aeaf-0a2052ec6ac6"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--dbbfa2d0-91b1-5893-b5b0-c0223559a725","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--9926cc6c-7885-5291-ad5d-809b43c4a0f3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--25dd392f-0a84-5f95-a955-327ffed72c7c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--51ffae24-2814-5df8-9ab9-4c75255b34a7","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--d2c2dbf7-0d14-5dc3-9f2f-e766d3ef1e12","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--1fcd0b86-8eb3-5c75-b8d7-f1c38b499482","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--7566a6b8-6b1b-54eb-b7e8-7afb8f437aab","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--62937e5c-e376-576b-9211-a56686126ba2","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Exfiltration Over Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567","url":"https://attack.mitre.org/techniques/T1567"}]},{"type":"relationship","id":"relationship--5b14dc99-29aa-5efa-8540-7bf00758446f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--62937e5c-e376-576b-9211-a56686126ba2"},{"type":"attack-pattern","id":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.001","url":"https://attack.mitre.org/techniques/T1583/001"}]},{"type":"relationship","id":"relationship--cca8cc3b-3e09-5489-b7a6-17ea6dc3e8b4","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--bd2fb8e8-a0e1-5571-9af7-39403fcd62a2","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--82621a4e-8b9b-5cbe-9c69-6ee00b8fc203","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.001","url":"https://attack.mitre.org/techniques/T1589/001"}]},{"type":"relationship","id":"relationship--a08ba696-0769-5e84-9640-1da6d8d99ad4","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45"},{"type":"attack-pattern","id":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Gather Victim Org Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591","url":"https://attack.mitre.org/techniques/T1591"}]},{"type":"relationship","id":"relationship--3ae4166a-40c7-50f6-875f-d669b7789bf7","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15"},{"type":"attack-pattern","id":"attack-pattern--5d5354dd-b522-5f58-be96-23e5eb35d71c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Search Open Technical Databases","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1596","url":"https://attack.mitre.org/techniques/T1596"}]},{"type":"relationship","id":"relationship--90db9add-6bcf-5a12-bfee-57436feb11ea","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--5d5354dd-b522-5f58-be96-23e5eb35d71c"},{"type":"attack-pattern","id":"attack-pattern--840e1a27-be04-5d9b-863f-8b073b470b0f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Phishing for Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1598","url":"https://attack.mitre.org/techniques/T1598"}]},{"type":"relationship","id":"relationship--776b9aee-b828-504c-a7e1-e1496f47cc7a","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--840e1a27-be04-5d9b-863f-8b073b470b0f"},{"type":"attack-pattern","id":"attack-pattern--0a618fe7-1288-506c-aeba-04fd20ba956c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Wi-Fi Networks","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1669","url":"https://attack.mitre.org/techniques/T1669"}]},{"type":"relationship","id":"relationship--bf0602cd-adfc-54e1-b93a-92b596c3b7e0","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--0a618fe7-1288-506c-aeba-04fd20ba956c"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--cb9abb31-d63c-5af6-a7c3-e868fe83e715","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"uses","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"location","id":"location--26bd43ce-64de-567e-a36d-0f23691c63dc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Armenia","country":"AM","region":"asia"},{"type":"relationship","id":"relationship--8c5db100-764f-5e1b-824d-728a31eba7cd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--26bd43ce-64de-567e-a36d-0f23691c63dc"},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--32457f2d-c10d-55c5-9c1e-623e5b12e945","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--2f8c0a39-07cd-541d-ba8e-0d38a3c4d1c7","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--bc7a0ad0-fe41-5c06-8d9d-8a1e4ad92b52","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Belarus","country":"BY","region":"europe"},{"type":"relationship","id":"relationship--e21431fc-f0b9-5d80-833b-f479250748d9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--9e33c1b1-d599-5a98-913b-362ba491b564","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--0764f8a4-43ff-5ae0-861d-4e2c6c1398c0","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--9a0f54da-467b-5a0b-abe7-e7777edd1099","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--480bdbf9-ff81-5fd7-839c-b326ed1434cd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--2eeaec7b-7dae-5258-a3f9-8196b80ad190","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Croatia","country":"HR","region":"europe"},{"type":"relationship","id":"relationship--dc79fb1f-6270-5f30-a5ee-1b42605f798b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--2eeaec7b-7dae-5258-a3f9-8196b80ad190"},{"type":"location","id":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Hungary","country":"HU","region":"europe"},{"type":"relationship","id":"relationship--ff461b02-df8d-5777-bbe0-ddf2c969291b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--cfdcfa5a-4425-571f-b55e-fa78a1b94465","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--cd612633-e4bc-57d1-a164-951398d5f0bc","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--ce34f471-efca-5eb1-8ac3-9ce4d2ba9e10","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--0cc52679-69d5-51c5-b375-66358567c08b","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Latvia","country":"LV","region":"europe"},{"type":"relationship","id":"relationship--a54b5b76-b90f-5cd9-9928-d6b5587ee4f9","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--0cc52679-69d5-51c5-b375-66358567c08b"},{"type":"location","id":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Montenegro","country":"ME","region":"europe"},{"type":"relationship","id":"relationship--ea79a8c6-5bbe-51f0-a9b4-03c6c4997092","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--38f2651c-b3e6-57ed-8108-05dcb71e2020","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--9f84c342-baa9-598d-a4bf-fbb8110fffdd","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--9cb535c5-4870-5fcd-a638-a6fb13a11273","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--94b84d12-7dfb-58a3-beee-9675b5717b84","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Romania","country":"RO","region":"europe"},{"type":"relationship","id":"relationship--45556415-c5b9-5970-80b6-5cff6e720736","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--94b84d12-7dfb-58a3-beee-9675b5717b84"},{"type":"location","id":"location--48c0566b-263f-5cdb-b529-4f2715353a59","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Serbia","country":"RS","region":"europe"},{"type":"relationship","id":"relationship--5e29bfc1-d7bd-5868-8efe-ccbb379b2a43","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--48c0566b-263f-5cdb-b529-4f2715353a59"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--3ca31c37-7a02-5e2d-a670-ce8639321dde","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--5335c49c-6927-5649-8a2c-06f868a6e189","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Slovakia","country":"SK","region":"europe"},{"type":"relationship","id":"relationship--525cd71a-fdc6-5b46-8806-d1a02018b479","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--5335c49c-6927-5649-8a2c-06f868a6e189"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--36514a84-67a7-500a-bdf1-fa4a16d34ec3","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--c101610e-3c82-519e-8943-ba6bf39ac87e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","name":"Uzbekistan","country":"UZ","region":"asia"},{"type":"relationship","id":"relationship--84ed806e-e2b1-56cc-8098-d5b4fc7f3b0e","spec_version":"2.1","created":"2026-05-18T19:45:21.688676+00:00","modified":"2026-07-28T19:39:13.208+00:00","relationship_type":"targets","source_ref":"intrusion-set--0912f39c-2fb2-59d0-942a-f131307a19f0","target_ref":"location--c101610e-3c82-519e-8943-ba6bf39ac87e"}]}