{"type":"bundle","id":"bundle--6d6394cb-198b-5b6b-a134-77deb5412324","objects":[{"type":"intrusion-set","id":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"APT41","description":"Dual-purpose Chinese threat group conducting espionage and financially motivated operations.","aliases":["Group 72","Winnti","WICKED SPIDER","LEAD","WICKED PANDA","Axiom","Brass Typhoon","TG-2633","Winnti Group","ATK17","Blackfly","Grayfly","Earth Baku","Suckfly","DOUBLE DRAGON","BARIUM","G0096","BRONZE ATLAS"],"first_seen":"2012-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt41"},{"source_name":"mitre-attack","external_id":"G0096","url":"https://attack.mitre.org/groups/G0096/"}],"labels":["nation-state","esp","sup"]},{"type":"attack-pattern","id":"attack-pattern--122f4216-e84f-5492-928b-204029908e14","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1001.002","url":"https://attack.mitre.org/techniques/T1001/002"}]},{"type":"relationship","id":"relationship--c5409cfe-d2b4-5874-9ec5-37550f15e4e7","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--122f4216-e84f-5492-928b-204029908e14"},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--7d400ad8-b8b9-523d-b8ff-889b3d4df2c5","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--0d712dfe-dc57-5ecc-8b84-28982cd5dba7","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--cacec4e8-54a5-5319-a746-3f55c05b7cd1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--4a767e9d-23e0-5f22-adf3-4310ec2a0a64","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--4e6cc22c-e96a-55b0-bbd5-0c759d6a628f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Fallback Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1008","url":"https://attack.mitre.org/techniques/T1008"}]},{"type":"relationship","id":"relationship--3a0c2638-b2ba-5b05-9d57-d20e7a585447","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--d26d66bb-ff34-5918-9fb4-a473575a7589","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Rootkit","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1014","url":"https://attack.mitre.org/techniques/T1014"}]},{"type":"relationship","id":"relationship--ed04cae2-62c5-5d82-88fb-48f0ea2fe1f0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--59eed13c-714a-5f77-aa9f-44e656d48676","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--fccea393-eb82-5420-bc1d-d5dbfc87cff6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--14d90d5f-3878-5495-a5e8-a0de626f503d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--dfc43763-99f9-5d6e-b93e-22971142aa51","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--18ec91c0-1f3d-5130-8f5a-00e2657cfef1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--c069cfca-b6b7-55c8-ac70-15a91f57ef7b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Data Transfer Size Limits","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1030","url":"https://attack.mitre.org/techniques/T1030"}]},{"type":"relationship","id":"relationship--33c96380-affb-5611-9db0-27f9eb0d02c0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--637f6d0d-c747-5011-8685-fc4f0dc2a161"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--7a4d6c05-dcb7-596c-9ef0-caf7cd61ed8f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--b513ce26-4465-53c2-b83b-4d9a0d2beed5","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--a8df01b8-e896-5f37-9a66-f3bb6b7334cc","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Boot or Logon Initialization Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037","url":"https://attack.mitre.org/techniques/T1037"}]},{"type":"relationship","id":"relationship--b7914412-ba74-5b76-9fc5-d77bbbee625d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--acb231e2-edb0-5ad0-8c4d-57369bf5e95c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--db82e66e-e742-5202-a64d-6203a9548881","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--1b7e1106-a47e-5684-9ffc-fa8a6e2a19f2","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--18530a80-93f7-57f9-b5cf-08636b0fc1fe","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Process Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055","url":"https://attack.mitre.org/techniques/T1055"}]},{"type":"relationship","id":"relationship--5191660d-e351-5d94-bba9-1d6187d1b382","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--280bbe20-ea46-569b-b54c-61364cc806c6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--2ef96470-6201-5870-b012-e01438636573","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--b42d0173-6ac9-5476-a3fb-89506123c03b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--7e6ae52f-5607-5d83-bdac-f42d09376873","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Unix Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.004","url":"https://attack.mitre.org/techniques/T1059/004"}]},{"type":"relationship","id":"relationship--2b54636e-8fa8-5918-a08a-b289bf559cb5","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6"},{"type":"attack-pattern","id":"attack-pattern--6e930dfe-b62c-5db1-b523-44f387d9af3f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Permission Groups Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069","url":"https://attack.mitre.org/techniques/T1069"}]},{"type":"relationship","id":"relationship--19d91364-65e4-590c-afc2-399b916bedaa","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--6e930dfe-b62c-5db1-b523-44f387d9af3f"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--c9bf4fc5-7d6f-56b3-8774-23a74c619000","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--76377c12-f3ce-5435-b708-db1bea4124cc","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--84ed2faa-d084-59dd-b273-43db6e745de0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"File Transfer Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.002","url":"https://attack.mitre.org/techniques/T1071/002"}]},{"type":"relationship","id":"relationship--0e97a42c-7455-532f-95b7-8418a86a01b6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--84ed2faa-d084-59dd-b273-43db6e745de0"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--c3f06435-de00-54e7-ad02-89ca943d66f1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--b5f1a994-692a-5d4f-9c1b-271140a63694","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"System Information Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1082","url":"https://attack.mitre.org/techniques/T1082"}]},{"type":"relationship","id":"relationship--154cbac8-6b27-562d-a619-a8e01422582f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--bca2cede-f0af-5b68-8163-7a3ed492f746","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--60992151-9aaf-5778-8576-3b7629f7fbe1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Dead Drop Resolver","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.001","url":"https://attack.mitre.org/techniques/T1102/001"}]},{"type":"relationship","id":"relationship--e4ad41bb-e156-5735-b468-2fee128771e0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480"},{"type":"attack-pattern","id":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Multi-Stage Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1104","url":"https://attack.mitre.org/techniques/T1104"}]},{"type":"relationship","id":"relationship--5b9e56fc-2699-56db-8156-0bb396053c31","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--ad51e257-0dcb-5347-8818-b09f0edf1440","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--3a3247ce-457e-5c62-9c1e-a1561c3d88ba","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--987f5abd-b8fe-5855-af39-c006b6a86883","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"External Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1133","url":"https://attack.mitre.org/techniques/T1133"}]},{"type":"relationship","id":"relationship--a36f9c5b-3b05-57d8-85ad-14c17978a5f3","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--78f18132-5a87-5d44-abab-da94d02592d5","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--8c43ba6a-9d66-5f3b-813a-59054f24274d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--eef01379-5bd1-5ab9-9063-b3fe88e216f3","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Compromise Software Supply Chain","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195.002","url":"https://attack.mitre.org/techniques/T1195/002"}]},{"type":"relationship","id":"relationship--9bc2693e-6f32-5855-be0c-42705214ef1d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70"},{"type":"attack-pattern","id":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"BITS Jobs","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1197","url":"https://attack.mitre.org/techniques/T1197"}]},{"type":"relationship","id":"relationship--eb7d9110-30d7-55d8-9363-fbe495bdfd2e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--e7dfc138-bc77-5445-a808-38d070fc9394","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--f41ad386-478f-53cd-bf6b-451466549360","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Compiled HTML File","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.001","url":"https://attack.mitre.org/techniques/T1218/001"}]},{"type":"relationship","id":"relationship--0e2666e1-7ba0-5818-b232-3aa3c65c42dd","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--f41ad386-478f-53cd-bf6b-451466549360"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--0824a163-22a9-52c7-81ad-3086df5df83b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--25999879-aeb6-54ba-96a4-7e7716f68aa5","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Environmental Keying","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1480.001","url":"https://attack.mitre.org/techniques/T1480/001"}]},{"type":"relationship","id":"relationship--95f32d59-2692-51f7-99c2-78fe4a859c51","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--25999879-aeb6-54ba-96a4-7e7716f68aa5"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--189ce18f-ad4e-5823-a301-a539ed58e5b6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--b8932c77-8c58-582d-8266-42a356613393","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--dde951e9-6535-515e-81e5-3d0db25158fb","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Pass the Hash","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.002","url":"https://attack.mitre.org/techniques/T1550/002"}]},{"type":"relationship","id":"relationship--7982f1a5-bdef-5ee2-a9a8-9ddfd073fabe","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e"},{"type":"attack-pattern","id":"attack-pattern--4f1d0d98-e550-5b2d-8a73-4c87ee6b1dc7","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Subvert Trust Controls","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1553","url":"https://attack.mitre.org/techniques/T1553"}]},{"type":"relationship","id":"relationship--2bb7a070-12b4-5b65-bd37-18843a53a3ca","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--4f1d0d98-e550-5b2d-8a73-4c87ee6b1dc7"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--c239addd-7b81-5a05-8586-cc149cf4d801","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--cb6c52ca-9106-53f4-9862-cb2841356a16","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--2ebd4cf6-bbea-5737-9123-91274548f673","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--dda1eb12-80e8-5d9f-9b5c-a79d37ac59d7","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--ef9bb477-996b-5fdd-9fc2-39ec026a41ea","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--80da0d28-19b1-5edb-9b25-c2cfe3b06b35","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--e73c927e-f552-54b4-85a2-cdb2de67aa9e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.001","url":"https://attack.mitre.org/techniques/T1583/001"}]},{"type":"relationship","id":"relationship--e4732977-13fc-5dc1-8516-95aade6d4e24","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd"},{"type":"attack-pattern","id":"attack-pattern--27ebfc8b-8b17-5ffa-b0dd-de7c850c6293","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"DNS Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.002","url":"https://attack.mitre.org/techniques/T1583/002"}]},{"type":"relationship","id":"relationship--ee9af29a-a1f2-5741-9f95-7eca09b2e53c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--27ebfc8b-8b17-5ffa-b0dd-de7c850c6293"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--5b82c181-eb07-5673-a161-d498f6812b33","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--fc5dcd5a-dc9e-574d-8be2-53573b556856","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Scan Databases","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1596.005","url":"https://attack.mitre.org/techniques/T1596/005"}]},{"type":"relationship","id":"relationship--61c7c522-bc30-5be1-b4af-d5b6d5c13510","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--fc5dcd5a-dc9e-574d-8be2-53573b556856"},{"type":"attack-pattern","id":"attack-pattern--fa743ed2-ed92-58ec-a82f-f0b805b8ad4b","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Network Boundary Bridging","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1599","url":"https://attack.mitre.org/techniques/T1599"}]},{"type":"relationship","id":"relationship--ce5a5349-cccf-5e2d-8e4a-3bf9c48929ba","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--fa743ed2-ed92-58ec-a82f-f0b805b8ad4b"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--8b4d0a44-7887-5270-bcdb-051b01b13096","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--1735eeae-72af-508d-aad8-ed563eae4cf0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"uses","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--7c486f2d-fddf-5acf-9f70-648344af727a","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--e0e919ae-7860-56a2-8fd2-f736e8cc1234","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--2e0f234c-a919-50dc-93e6-6884ef5c8ae4","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--81af57ac-643e-5295-910f-3d0e5ffd270a","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--d542d3e1-857f-51fb-9a32-ff7653e05bc0","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--18b3bf75-203b-5380-8bc1-e17d77a27f8d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--931470c9-b47e-557a-ac82-5aec31c88d36","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--a511be5e-2c92-55d8-b540-c8c97fc9bed1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--a469823c-57b5-53b0-8a76-fcda899f00c1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--808edd86-81fc-58c6-9723-25ac3bfeda38","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--11999f82-579a-5ae1-9194-090258c8c5fd","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--54d283c0-7b8d-50a5-92aa-29f6acbe6b35","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Kenya","country":"KE","region":"africa"},{"type":"relationship","id":"relationship--0e766251-21ee-578a-a920-6ae2d00250db","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--54d283c0-7b8d-50a5-92aa-29f6acbe6b35"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--caa819df-e54e-5dd5-b3a6-5ea9f4903c51","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--e7ca24e6-1269-5e86-963a-2d0e9e3c48de","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--65f9d1ed-f890-5422-9b80-26fc28964f39","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Mexico","country":"MX","region":"americas"},{"type":"relationship","id":"relationship--9f52382b-4093-556b-9bd7-61b3907a6b0e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--65f9d1ed-f890-5422-9b80-26fc28964f39"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--5a1cbdbc-7823-5869-8408-434dcd7a85c3","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--95962fdd-b293-5857-ac0b-c1d90c192eeb","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--1933c0ee-2ce7-5016-a4a3-4d0b4bb33b17","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--0753cb03-c40b-5056-baa6-4cc4bb8de68e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--17323a2f-0f71-5a30-9177-360d9e562329","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--8eadb305-9209-593a-bca9-cd9b3af4681e","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--0020e578-a9f5-5f1a-8149-d7e82341cfe2","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--b8c18597-8096-5a6d-85af-eb28b02d0f6c","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--1b2ee7ac-0093-5caf-a6f2-561ce5105d31","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","name":"Uruguay","country":"UY","region":"americas"},{"type":"relationship","id":"relationship--5ba3b484-4e98-5170-a6f9-392b3f604ffc","spec_version":"2.1","created":"2026-05-18T19:45:25.160701+00:00","modified":"2026-05-20T09:50:17.615197+00:00","relationship_type":"targets","source_ref":"intrusion-set--e5b66968-c056-53e1-a8f7-0d55fb1bba3c","target_ref":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440"}]}