{"type":"bundle","id":"bundle--edaebb78-ee45-5c61-b28a-f2667ddbdaae","objects":[{"type":"intrusion-set","id":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"APT32","aliases":["OceanLotus","SeaLotus","Canvas Cyclone","APT-C-00","SectorF01","Ocean Lotus","Cobalt Kitty","OceanBuffalo","BISMUTH","OCEAN BUFFALO","G0050","TA461","TIN WOODLAWN"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt32"},{"source_name":"mitre-attack","external_id":"G0050","url":"https://attack.mitre.org/groups/G0050/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--557ba4a5-a9fa-56b3-82c7-91a9d0434fc7","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--b155ce3c-52ac-5607-ab6b-3df158c3edde","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--1b732408-8c49-5d54-8d96-b648cd45749b","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--e286c05c-8815-50c9-bc26-16fc6b63dd28","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--fcddcf95-72cb-5b3f-885c-9bec1303620e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--eea91d90-5504-5a7d-8c35-3cca4470822d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--55655ba4-2365-5683-a4a7-33df56f315dd","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--d35b7da0-da1a-5826-99ab-1ef51cb6ab1a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--02c4c789-629e-515c-870a-c9d7902131e3","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--28cfd681-fb93-581c-b94c-7fd82528d106","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Rename Legitimate Utilities","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.003","url":"https://attack.mitre.org/techniques/T1036/003"}]},{"type":"relationship","id":"relationship--697b2c6f-604c-50c8-b890-b8b58bfe7e82","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--28cfd681-fb93-581c-b94c-7fd82528d106"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--a0abbe5b-72c5-5ded-9130-8846596b6fd3","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--fc67c37f-9de3-5bae-b306-0b17bdddf15c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--0c31040b-1baa-5921-800c-b29a03e6fe30","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--dadf1c2a-97b8-53ea-825b-b715a407a6d6","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--6de2793a-0af1-5585-84d8-5613086bfda0","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--56548e63-5619-5f3e-8d1b-bb70b565a116","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--426abbb4-953a-5c3c-b4d1-fe1d44eb2173","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--165659d9-a721-52b1-9215-2976100f2919","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Process Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055","url":"https://attack.mitre.org/techniques/T1055"}]},{"type":"relationship","id":"relationship--06f82cb8-2129-5d4d-be4f-da01de191855","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--b39ba3fc-0b9b-5471-98de-efbb16e7cf43","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--590195e2-32ad-5bb4-b01b-9bb87e3d412c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--7c558294-6e9d-50a7-af55-e168efe35d75","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--e4e5e59c-5426-5620-9d15-af5d32078deb","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--7c3284e7-be7a-5adb-8777-156ead12ec48","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--37e49088-2b8f-5b0f-a4b9-d190e375a034","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--9f8b0f63-205a-572d-9991-95185fb7583b","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--f0e6649d-f80d-52af-bcfc-fd742a51c825","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Mail Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.003","url":"https://attack.mitre.org/techniques/T1071/003"}]},{"type":"relationship","id":"relationship--32091be2-42a7-5963-bc10-2c09fd520e8d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e"},{"type":"attack-pattern","id":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Software Deployment Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1072","url":"https://attack.mitre.org/techniques/T1072"}]},{"type":"relationship","id":"relationship--dba497b2-96d6-5e30-81ff-f7d896193076","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--ca06b70f-8b14-5f67-8831-0c5d2b9357f9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--4c376bcc-2353-5567-a4d3-8589d1f571f4","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--e427d382-75d7-594e-80d7-5acdd4abd53a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--1569ae79-1fef-5a29-a0aa-2c02d6bff0ff","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--06c8baca-e171-5d4e-848e-04d580b4f89c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--869f18d8-58fe-52fa-903e-902edd12c360","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--c00e51e1-2cb0-567f-a800-3fe86a08e29d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Office Application Startup","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137","url":"https://attack.mitre.org/techniques/T1137"}]},{"type":"relationship","id":"relationship--5a68b4de-9897-5f3a-9915-b05c3985f2dc","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--c00e51e1-2cb0-567f-a800-3fe86a08e29d"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--4034a812-1efd-5157-b759-662884bff046","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--606d894a-69cc-5cbf-908a-7fdd02245394","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--68ae8f2b-fa64-55bd-aee7-2a169ddbdb9f","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--6c1097fa-1039-5f55-a546-744522b73d93","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Regsvr32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.010","url":"https://attack.mitre.org/techniques/T1218/010"}]},{"type":"relationship","id":"relationship--d091e44d-7fb0-5a26-83a7-7aebf7de0b75","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--60d8b3c2-d312-5986-a1eb-99c4ac1585f9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--0e48eb7d-a917-55fa-a026-42f54cbe52e2","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--a8d62d1b-fcab-5075-a326-0ed19e9e84e3","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Pass the Hash","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.002","url":"https://attack.mitre.org/techniques/T1550/002"}]},{"type":"relationship","id":"relationship--fd7ccb5a-af82-5880-9fa7-a85afff16cbe","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e"},{"type":"attack-pattern","id":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Pass the Ticket","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.003","url":"https://attack.mitre.org/techniques/T1550/003"}]},{"type":"relationship","id":"relationship--09e0ac4f-8f42-5154-a730-20efbee937f4","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb"},{"type":"attack-pattern","id":"attack-pattern--3cbd6ef5-4c9e-5534-83c2-2d75be3f1d71","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Credentials in Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.002","url":"https://attack.mitre.org/techniques/T1552/002"}]},{"type":"relationship","id":"relationship--a18a4f3d-b723-5a9d-80ba-08aa30d3d273","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--3cbd6ef5-4c9e-5534-83c2-2d75be3f1d71"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--9dd69e21-816f-51ce-a632-93ae71f8efc5","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--50169c49-d99a-5660-b037-56810423b33e","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--fcf2e61c-f24a-574b-98a7-9a980fc66807","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--df23aa54-2f9b-5272-aa17-a9a5f849b56c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"NTFS File Attributes","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.004","url":"https://attack.mitre.org/techniques/T1564/004"}]},{"type":"relationship","id":"relationship--3f380cbe-c3b0-589b-bfcf-f81a474ab4e9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--df23aa54-2f9b-5272-aa17-a9a5f849b56c"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--6d051a72-fd8a-5904-aab7-c8b6159b1d5a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--6ada4565-cf22-5345-a80d-a0b2d8293267","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--89dd0dd3-be3b-5c5b-99f6-df5a216b944c","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--554f6f1b-6ec6-59a5-a10f-608eeb8bd573","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--40e065b2-0697-509a-b7de-b5fcff4ffb55","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--44c10dc0-ff69-5f7d-8f6e-64a8d3265acc","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"uses","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"location","id":"location--68fe669f-7a5b-503d-9e0b-4061b122b7ad","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Bosnia and Herzegovina","country":"BA","region":"europe"},{"type":"relationship","id":"relationship--7b516e94-3745-55c1-804b-67e6c2e5cd36","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--68fe669f-7a5b-503d-9e0b-4061b122b7ad"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--291fb785-c45d-5cac-99cd-1900a808a373","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--406de26e-5eee-5a9c-9aee-a8da7181140f","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--d5a0b456-d375-52c6-9e42-83880e467747","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--0cec3823-36f3-5ed3-b46c-7937fb8d0e32","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Cambodia","country":"KH","region":"asia"},{"type":"relationship","id":"relationship--4174ee28-9706-5ae4-b7b7-3df2d0916087","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--c70e2704-0a4d-5468-b805-c0e10aac441a","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--9ce39003-d8da-5720-bfc3-fe2f441393e3","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--15d13e32-bd55-5bfe-b5e9-7654a2c1dfb0","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--def4ad3c-c230-56e5-94c0-b6ff62ff37b6","spec_version":"2.1","created":"2026-05-20T09:50:15.289162+00:00","modified":"2026-07-28T19:43:37.607+00:00","relationship_type":"targets","source_ref":"intrusion-set--1ea9addd-88b3-5a86-bb2e-0fdeb90bbf9e","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"}]}