{"type":"bundle","id":"bundle--171ceb31-4226-57fe-bb7e-0e403292a048","objects":[{"type":"intrusion-set","id":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"APT35","aliases":["Newscaster","Mint Sandstorm","Magic Hound","Educated Manticore","NewsBeef","Yellow Garuda","ITG18","Phosphorus","CHARMING KITTEN","G0059","TA453","COBALT ILLUSION"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt35"},{"source_name":"mitre-attack","external_id":"G0059","url":"https://attack.mitre.org/groups/G0059/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--2188906a-46ca-5320-8bee-151dbd87ed12","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--3d279506-5706-5cbf-89a3-d87919d6fc5a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--7788ec56-033e-5c59-a9d2-fb8655b2fc6f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--54529d59-5465-5e0d-bad8-a6c3932d250e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--368d500f-ad11-5827-be39-44551e940bba","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--59cfc977-a3c7-598c-abde-5cc402585cd5","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--c6e8296d-58a0-593e-af69-8f501c10f1c0","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--bb85c1ed-a8aa-5309-bed1-86aa78338fd8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--b3bb0880-1c3a-5eca-b6dc-3a5671c9ec1e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--cf338f6c-ee5a-508d-bb69-ba1881dd5dd0","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Masquerade Account Name","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.010","url":"https://attack.mitre.org/techniques/T1036/010"}]},{"type":"relationship","id":"relationship--a14fa38b-558a-5aa8-8185-1a56c0f0cf21","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--cf338f6c-ee5a-508d-bb69-ba1881dd5dd0"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--f8c7d461-0891-5527-b856-a9adb4b3f005","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--510cba7b-7d7a-52ac-b7c8-8256aaee46dc","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--630d0117-c237-50a4-856e-3af0fafae847","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--952dd937-815d-528a-ae87-17f5d50a24cc","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--f4a7c5ce-85e3-5e4e-ac10-f07dde52626f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--8c0b0d09-6ea7-503f-8c03-2aa4b65b1faf","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--c6786319-c1c0-5644-8b0c-b9d2e4356d55","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--b1f78bf0-862a-5228-9533-638f82506f9b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--d713a631-6615-5f07-bfc7-aa979f5ff480","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071","url":"https://attack.mitre.org/techniques/T1071"}]},{"type":"relationship","id":"relationship--b5872ddc-9660-5ada-90e1-627453feed64","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--1500241b-9322-51c8-8055-133e8eb1e401","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--1b48823d-d957-56f0-ad5f-797105276edf","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--26879e48-c074-5467-8e9e-0b2aa5344851","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--f7144e20-19aa-5f94-9237-7947fe70eb50","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Additional Email Delegate Permissions","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098.002","url":"https://attack.mitre.org/techniques/T1098/002"}]},{"type":"relationship","id":"relationship--c05b11d6-e164-5345-bb9d-5ba9de2167c8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--d96c239f-a531-5fed-a2a8-8a8ae3e4ad11","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--0cab2e54-08a7-58bc-b812-3c82318fec9e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--d1d428a3-492d-5cfd-9310-86191157a3bf","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--523ab840-7482-5323-8094-8880bdb69bcd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--460da175-5b29-5f68-90da-2161d0da23b7","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Local Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.001","url":"https://attack.mitre.org/techniques/T1114/001"}]},{"type":"relationship","id":"relationship--ae7b6cfa-0e1b-5eb6-a42d-be9733b07bab","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--460da175-5b29-5f68-90da-2161d0da23b7"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--74744c30-3f79-5639-8123-6e07fb6f8b85","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--79807983-2745-522d-a94a-41f929f565df","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--3b771460-8878-575d-a70c-91cc8c1728cc","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--48d46c1b-4dc1-5c27-9964-ccf3d72530d7","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--f72c03b6-2f42-55c6-92f4-28dd4f0d50dd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Domain Trust Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1482","url":"https://attack.mitre.org/techniques/T1482"}]},{"type":"relationship","id":"relationship--05b95cb3-c3b5-5391-90b6-2060e37808f7","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--235bb200-9972-5b67-90f7-7a87b79016f6","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--d7b74fae-13aa-5e37-b165-969da3305339","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--f674412a-41fe-50fb-ba3f-1b1df256a2b8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--44386078-6543-5c19-b01b-1935e29f044a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--03b942ef-f7ce-5f13-98ce-0f2b559cd97a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--2933d14c-79fc-5614-b454-9f9f1e8cb944","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"attack-pattern","id":"attack-pattern--62937e5c-e376-576b-9211-a56686126ba2","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Exfiltration Over Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567","url":"https://attack.mitre.org/techniques/T1567"}]},{"type":"relationship","id":"relationship--7ae875b9-1785-5942-af2e-863223b20ccd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--62937e5c-e376-576b-9211-a56686126ba2"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--6d3be766-0592-5756-8d44-d9cd936d15d9","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--323aff79-a1d0-5daa-9ad1-c635dbc58ecc","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Encrypted Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573","url":"https://attack.mitre.org/techniques/T1573"}]},{"type":"relationship","id":"relationship--6c620eb1-4b3e-5232-a289-e3a7ceaceb20","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--8ca20517-f238-5426-b974-71399672c103","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.001","url":"https://attack.mitre.org/techniques/T1589/001"}]},{"type":"relationship","id":"relationship--53fd8d0f-373e-59a6-9354-c3e25e3874ed","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--b7f7fa99-0db6-58da-b1c5-db0f3041edc8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--5381b619-b75a-5a20-9a6a-a14b02441178","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Determine Physical Locations","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591.001","url":"https://attack.mitre.org/techniques/T1591/001"}]},{"type":"relationship","id":"relationship--1e3100b6-40e1-536c-bbbe-3c8369b29050","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--5381b619-b75a-5a20-9a6a-a14b02441178"},{"type":"attack-pattern","id":"attack-pattern--73f95eab-a03c-580b-a3f4-612c5f9bf052","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1592.002","url":"https://attack.mitre.org/techniques/T1592/002"}]},{"type":"relationship","id":"relationship--5f8a8404-f4fd-5f4b-8484-c2be242fee91","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--73f95eab-a03c-580b-a3f4-612c5f9bf052"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--561ff1e9-56d6-57da-a0a3-58af05688636","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"uses","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--693ea96f-451b-5335-9926-286e1f2fe169","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Albania","country":"AL","region":"europe"},{"type":"relationship","id":"relationship--2127cdab-1405-54c8-b4d3-7544862f7c44","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--65ec267d-7323-5a7e-9dab-327306f816e8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--2da3bb22-42f9-50db-8059-c3a0023f7317","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Azerbaijan","country":"AZ","region":"asia"},{"type":"relationship","id":"relationship--164ca5e9-ec24-5023-b856-76577c11cf3f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--2da3bb22-42f9-50db-8059-c3a0023f7317"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--46ba7ca4-22df-59a0-9bb4-091ed03f790c","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--518ed095-0061-5179-95eb-3cedc21bceb1","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Egypt","country":"EG","region":"africa"},{"type":"relationship","id":"relationship--1e7449b1-fd32-5860-aeae-87a75b3c9f76","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--5e2dc6f1-2566-5138-9e68-ba122e38e770","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--f933400c-9a7c-55b6-b485-10b124044308","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--cdae6416-0e34-5f77-9b56-8108349b658c","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Iraq","country":"IQ","region":"asia"},{"type":"relationship","id":"relationship--1ece125f-6adf-5010-911d-dd19fc4ed5ec","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--e9c52a17-7450-51b3-a921-2a43ddcb2cab","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Kuwait","country":"KW","region":"asia"},{"type":"relationship","id":"relationship--4edb00d8-7430-51d7-b831-e1e927351cc4","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76"},{"type":"location","id":"location--0cc52679-69d5-51c5-b375-66358567c08b","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Latvia","country":"LV","region":"europe"},{"type":"relationship","id":"relationship--81b7a380-ba36-544a-82b4-eab6b890c1db","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--0cc52679-69d5-51c5-b375-66358567c08b"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--4f90a8e5-3700-5539-aa0c-fda31aa052b8","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--57f71bfc-ec5f-540a-baf3-dd1b53934e59","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--002056aa-26d8-546a-be3b-5ba8d1f067a3","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--a99f835a-c8ef-52fb-90e6-7d1dc293b1b0","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","name":"Uruguay","country":"UY","region":"americas"},{"type":"relationship","id":"relationship--e7b87a9d-dca8-5116-8404-9ff22fb3e469","spec_version":"2.1","created":"2026-05-20T09:50:16.041053+00:00","modified":"2026-07-29T11:39:03.81+00:00","relationship_type":"targets","source_ref":"intrusion-set--c8b89950-b3fd-5f71-8b33-64280eabd793","target_ref":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440"}]}