{"type":"bundle","id":"bundle--edb224a5-8f53-516b-9107-dbfb618123da","objects":[{"type":"intrusion-set","id":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"APT34","aliases":["Crambus","IRN2","ITG13","EUROPIUM","OilRig","ATK40","Earth Winona","Chrysene","HELIX KITTEN","Hazel Sandstorm","G0049","TA452","COBALT GYPSY"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt34"},{"source_name":"mitre-attack","external_id":"G0049","url":"https://attack.mitre.org/groups/G0049/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--3bc9c1b4-c672-5ba5-88b3-e49db02a0474","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"LSA Secrets","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.004","url":"https://attack.mitre.org/techniques/T1003/004"}]},{"type":"relationship","id":"relationship--7b13cb68-a073-55ab-8096-d33a828b0991","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e"},{"type":"attack-pattern","id":"attack-pattern--d4d038b7-2005-5308-95a6-a4c470a4d947","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Cached Domain Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.005","url":"https://attack.mitre.org/techniques/T1003/005"}]},{"type":"relationship","id":"relationship--3192e8ee-5949-5a7e-a740-e5986b91c5e5","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--d4d038b7-2005-5308-95a6-a4c470a4d947"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--6aa4b228-04f7-57ac-b875-a8b09227ab0c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--e94884f9-0a02-5d21-9968-3dafe7569eb4","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Fallback Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1008","url":"https://attack.mitre.org/techniques/T1008"}]},{"type":"relationship","id":"relationship--364d050a-da8c-5ce6-aadb-38afa86321e8","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--5392bddf-bb88-5bc9-a2b2-f9daea5d27a8","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--021987df-9990-5a4d-b5f0-53ee4cb441fb","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--2e2fe413-4708-57d0-9f93-832e9875a670","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--1f7d64c3-e61a-501e-9418-8405567efd22","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Data from Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1025","url":"https://attack.mitre.org/techniques/T1025"}]},{"type":"relationship","id":"relationship--21bc756a-225a-5fda-86e6-8af289a02a53","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--4d41846e-bcc4-5616-923a-7b86ed0cc4da","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--16a7b4c7-e69d-502d-aa49-4275b13f6311","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--6706006a-b4fe-5fda-846d-443c009373f8","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--2f20221f-ffaa-5da4-9209-ba4704286bc1","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--f4666c7d-50ad-5a6f-a9d4-a1045a521d67","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--825f1368-fbbe-561f-ba1b-10c69ec814e3","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--43a9de1d-e3b3-5f2c-a163-dee205b63158","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--bc19bc68-d5c2-5845-b1ba-4edf25abc6d0","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--4ecb299f-4bfb-595c-ae02-b6b23a9e42cb","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--63862ee8-58e3-561a-9720-2df243a6faf6","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--5ad52f81-f3c5-50dc-9b1b-d1d3a43d0ded","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--84125477-874e-5279-b74c-dc4ce727e1f9","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--443db359-80a8-5522-9066-526e2f538dce","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--ed31c3cb-6d5c-51b0-825c-be138fe1a41f","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Local Groups","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069.001","url":"https://attack.mitre.org/techniques/T1069/001"}]},{"type":"relationship","id":"relationship--1c20060c-fe7d-555a-b4c0-e46b62b11e85","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--e9e71d94-0c06-58d1-a7d0-6049fce13418","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--bcfabbd7-21a7-5d21-8b89-673734765b0b","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--9b5d7481-05ba-5d92-b338-f242e7286fb2","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--d95aa81f-eaa9-54b2-8690-1faaacfbbf27","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--132b64d4-51a3-56c9-a673-4e3c328bc128","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--1202e847-5479-5d67-8643-f835c9b3d53e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--8280ee23-23cf-5ea0-951e-278c6a242403","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--16e00a63-ab5e-5c3c-84ad-8f0c79ef2f41","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--7c4685ca-640c-58b2-a8a6-7fa0d6ac90c5","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--418ea7e5-19e7-573d-a868-31349e7cd91c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Clipboard Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1115","url":"https://attack.mitre.org/techniques/T1115"}]},{"type":"relationship","id":"relationship--7232d801-82e3-51e1-a401-ef5df0eb12d9","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--418ea7e5-19e7-573d-a868-31349e7cd91c"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--c777f3f6-4c47-5f17-a715-da566feb0a6e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--2b61eb48-24f4-523f-b7f0-5c1f35597634","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--077f8dc7-a694-57f1-aacf-056fc368d238","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Outlook Home Page","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137.004","url":"https://attack.mitre.org/techniques/T1137/004"}]},{"type":"relationship","id":"relationship--49c9d4f8-810f-5c60-b2c0-6103bbf7af5f","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--077f8dc7-a694-57f1-aacf-056fc368d238"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--619fc8bb-2f53-5846-98cd-61e0c83d7eb5","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--343c0739-380d-510b-9281-106ba73f460a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Supply Chain Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195","url":"https://attack.mitre.org/techniques/T1195"}]},{"type":"relationship","id":"relationship--31194549-73b0-5cdb-a381-3f147d4b3b32","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--343c0739-380d-510b-9281-106ba73f460a"},{"type":"attack-pattern","id":"attack-pattern--814da65a-28ca-529c-a554-38b7aebb59f4","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Password Policy Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1201","url":"https://attack.mitre.org/techniques/T1201"}]},{"type":"relationship","id":"relationship--1b3ca44c-7ed5-59fb-ad42-7aa64e9c5c7d","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--814da65a-28ca-529c-a554-38b7aebb59f4"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--32dc5691-8fa1-5ebf-9aa8-1705fdb5cd39","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--38c8ac08-b9e8-58ca-a3f4-6443341783fa","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--f41ad386-478f-53cd-bf6b-451466549360","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Compiled HTML File","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.001","url":"https://attack.mitre.org/techniques/T1218/001"}]},{"type":"relationship","id":"relationship--1e6576ec-927c-5f81-8578-59b3ec7465d7","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--f41ad386-478f-53cd-bf6b-451466549360"},{"type":"attack-pattern","id":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Remote Access Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219","url":"https://attack.mitre.org/techniques/T1219"}]},{"type":"relationship","id":"relationship--5266da4d-0be7-55bb-9ac1-b9a42b3e2438","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--3873cfa8-249d-5790-9f07-9f9df7f4507c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Credentials In Files","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.001","url":"https://attack.mitre.org/techniques/T1552/001"}]},{"type":"relationship","id":"relationship--34466f2b-d2f3-5f26-a0bc-976ce5f6ccba","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--43de8eca-5264-571b-ac41-10af7d75b469","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--11e82bcb-b34e-529d-b369-68114d64325b","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--5d42ba3f-98e1-5ffa-a5b0-a7728217273e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Windows Credential Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.004","url":"https://attack.mitre.org/techniques/T1555/004"}]},{"type":"relationship","id":"relationship--8ef5c6b5-9ad5-5905-8a7b-37b9c282be92","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--5d42ba3f-98e1-5ffa-a5b0-a7728217273e"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--30f68c78-a078-556a-b8e5-34a70342ebc4","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--49812c46-849d-51bd-bb2d-22860584d52f","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--053d14e4-b609-547c-842f-1270054d147e","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"attack-pattern","id":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Asymmetric Cryptography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573.002","url":"https://attack.mitre.org/techniques/T1573/002"}]},{"type":"relationship","id":"relationship--b2baeab1-1526-57be-aef9-3570379ebf01","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"uses","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--267690b7-7fab-54e0-aeaa-3451897ac6b2","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--d59b3ad1-e884-5ff9-8623-d68051e580ee","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--2da3bb22-42f9-50db-8059-c3a0023f7317","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Azerbaijan","country":"AZ","region":"asia"},{"type":"relationship","id":"relationship--e5d91562-c528-5f5f-afb8-95487b5dbbcc","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--2da3bb22-42f9-50db-8059-c3a0023f7317"},{"type":"location","id":"location--3db98014-8434-54ef-b886-ae0fb482b920","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Bahrain","country":"BH","region":"asia"},{"type":"relationship","id":"relationship--84593a02-4c5a-5ac1-bcff-94f9a4d44ddc","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--3db98014-8434-54ef-b886-ae0fb482b920"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--dbaf0084-f16f-56cf-9aa5-f9793b6f9b4c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Egypt","country":"EG","region":"africa"},{"type":"relationship","id":"relationship--600f9aaa-0c96-5131-9e01-fcfcbfc9d27f","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--a490504e-542b-5385-b8a3-b6bb3ee6ee38","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--5d4cef76-ac73-5e15-b813-1d3d3579cea6","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--4a028c7a-8214-5c52-a067-9bb1b11fc0d2","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Iraq","country":"IQ","region":"asia"},{"type":"relationship","id":"relationship--e2110687-9635-5f4a-9b2b-76d401e17606","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80"},{"type":"location","id":"location--6191aea2-8287-579c-b33a-22258b590363","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Jordan","country":"JO","region":"asia"},{"type":"relationship","id":"relationship--2a24b383-bd90-54d3-b2c9-33622520c9ab","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--6191aea2-8287-579c-b33a-22258b590363"},{"type":"location","id":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Kuwait","country":"KW","region":"asia"},{"type":"relationship","id":"relationship--1e57efcd-4a7e-52d6-a4ec-3ddc61dc7b91","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76"},{"type":"location","id":"location--671536e6-945a-50d2-812e-660a03c3dd58","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Lebanon","country":"LB","region":"asia"},{"type":"relationship","id":"relationship--98a21d11-7ea3-5a30-a699-cac7171e7536","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--671536e6-945a-50d2-812e-660a03c3dd58"},{"type":"location","id":"location--388b3c77-9b12-5466-8c1e-195673038612","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Mauritius","country":"MU","region":"africa"},{"type":"relationship","id":"relationship--608322e5-5d79-56a9-aeca-e9b48017a742","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--388b3c77-9b12-5466-8c1e-195673038612"},{"type":"location","id":"location--3cd79224-9615-55ee-8547-35f3201b8c4c","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Qatar","country":"QA","region":"asia"},{"type":"relationship","id":"relationship--d2645476-db90-5892-ad65-52d3e4e2c1b2","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--3cd79224-9615-55ee-8547-35f3201b8c4c"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--db7b3b47-f440-572c-a6b7-923e62964919","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--dc8deb76-913b-5a5a-b1d1-2e04b6fd32bb","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Syria","country":"SY","region":"asia"},{"type":"relationship","id":"relationship--86adf004-6826-5338-8f4c-e2147d2a0445","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--dc8deb76-913b-5a5a-b1d1-2e04b6fd32bb"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--87c8774e-9042-5198-bd10-df86459eb527","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--c0cca56b-85d3-5631-9a23-ebc07b44d85d","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--380ebd09-66ba-5daa-9804-464ca5dd0071","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"Yemen","country":"YE","region":"asia"},{"type":"relationship","id":"relationship--4a933531-c503-50f8-b271-e0b1eb1e5e31","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--380ebd09-66ba-5daa-9804-464ca5dd0071"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--56bd69ee-9709-5c1d-9249-729872f64afe","spec_version":"2.1","created":"2026-05-20T09:50:15.788916+00:00","modified":"2026-07-29T08:59:11.169+00:00","relationship_type":"targets","source_ref":"intrusion-set--574142b8-1694-5da5-913f-9146e157a059","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}