{"type":"bundle","id":"bundle--98aef758-6d92-546d-999b-ff85018338ef","objects":[{"type":"intrusion-set","id":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"APT3","aliases":["UPS Team","Buckeye","Group 6","Boyusec","Pirpi","GOTHIC PANDA","G0022","TG-0110"],"first_seen":"2010-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt3"},{"source_name":"mitre-attack","external_id":"G0022","url":"https://attack.mitre.org/groups/G0022/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--0ab1a52c-1b0e-50e2-8894-d9b28d4cc097","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--f467ded8-71da-5664-9036-d9e1bc21f9e4","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--20c2c52f-c864-5be1-bbbc-0e31eb4f2c96","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--5c9ccaa4-eff9-5af6-89d8-06a081743524","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--31f883b7-5501-5de8-bfc1-53fa08f9849a","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--0aadad29-e35e-58ee-8d8e-29d1d955bba2","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--a293ddad-6dbf-5fd6-b7d4-6e6ce819fdf8","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--85daf7c9-0c05-539b-996e-be55721943a7","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--06784489-f219-5f8e-a074-2df2489fa74c","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--cf338f6c-ee5a-508d-bb69-ba1881dd5dd0","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Masquerade Account Name","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.010","url":"https://attack.mitre.org/techniques/T1036/010"}]},{"type":"relationship","id":"relationship--d040640f-71f9-56a0-82ea-acce9cf8ffb0","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--cf338f6c-ee5a-508d-bb69-ba1881dd5dd0"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--d9330ee4-3c0e-51d1-b08d-f4585fb809b9","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--379ba4f7-9e2e-5564-a405-f431c52eae87","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--9e2a6de3-3e4d-57ad-840f-8237a39234de","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--45ff84eb-1848-5255-b9b0-1640bcab52d2","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--bbc197ea-5587-58da-b6c3-599242e42a2b","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--55a60c03-b236-53f7-869f-e8e335d07e88","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--9bebaad4-f832-5ec1-b8e9-05cff113dc59","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--66e94e46-b508-543e-8161-9a097d22d760","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--7cdee906-c078-5828-b772-cd6d2826a01c","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--3ac4ee27-4d49-5a48-9228-1ebfb19056a3","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Multi-Stage Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1104","url":"https://attack.mitre.org/techniques/T1104"}]},{"type":"relationship","id":"relationship--e4985016-aa2a-5351-9004-24af64dcf1b4","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--707707f6-8585-5046-9808-ba8e8fbdc8e0","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--e1d969f3-ba97-5eb3-90b7-b1e72c3c8492","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--d839f8db-9746-50db-a6b6-556c00c21b87","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--8b58a3eb-6e5f-5c50-9ca6-7fc9155b7a04","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--4cb3fe63-528a-5c37-bcf6-5192f90efe8a","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--2d8ced3a-a201-5e99-9d79-dd980e19ab08","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Credentials In Files","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.001","url":"https://attack.mitre.org/techniques/T1552/001"}]},{"type":"relationship","id":"relationship--cbcb9a79-655a-5810-83c0-04ff73d6c885","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--f115f67f-1ac4-51a6-bbc4-2e00c2ff7673","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--65892d7a-2299-5911-9058-bbdfadcb2f97","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--de5d46f3-0046-53ea-9a61-946a39c46204","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--ecad9ce8-7072-5514-adcb-cb163c5e3325","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"uses","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--57ee412d-9ccd-5bd4-a17c-33c4e29148cc","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--9d282fab-18b2-583c-9467-874af8598c06","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--25fe4ef1-b363-56c2-abaa-ec543215b065","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--6468b475-7168-5afb-8934-674b6765a1d9","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--c3546b00-a2c4-5232-a803-74a24bdbc9b8","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--b5b1986f-c0d9-58a0-8dea-f97389dc5579","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--01706041-75ed-5e38-91f1-5c20993fcb1a","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--abe7e340-71a1-5bf3-9d24-97980c27d688","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--007520ba-d02c-5adf-9c22-d0a2906b417f","spec_version":"2.1","created":"2026-05-20T09:50:08.397011+00:00","modified":"2026-07-28T19:39:13.721+00:00","relationship_type":"targets","source_ref":"intrusion-set--3cdc35d5-51a2-5739-adfa-e26ed4c712b1","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}