{"type":"bundle","id":"bundle--16346cbd-e0c7-57f9-8cf5-6d44611d6874","objects":[{"type":"intrusion-set","id":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"APT44","description":"GRU Unit 74455 destructive-attack and disinformation group.","aliases":["Sandworm Team","Hades","UAC-0113","BlackEnergy Group","ELECTRUM","Quedagh","Telebots","FROZENBARENTS","Seashell Blizzard","BE2 APT","Sandworm","GreyEnergy","IRIDIUM","VOODOO BEAR","G0034","IRON VIKING"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt44"},{"source_name":"mitre-attack","external_id":"G0034","url":"https://attack.mitre.org/groups/G0034/"}],"labels":["nation-state","dis","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--d3140676-edb5-5b09-ae99-167fcc906a06","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--e63598e0-d38f-5af0-bcd4-d6d7806abcf6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--292eb6e9-eb88-5a68-8eb3-706213990a3e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--2e0a8805-0802-517a-9f03-50d3e3b1df88","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--3152e522-405a-5b23-afc9-0aeab18d5fb1","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--d12948d3-25cf-5408-ab64-1ab2ec6decaf","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--75f6f44a-71f7-5e71-89d5-d867350eb2dd","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--3b8efc89-d190-5828-aa38-fe9f1ee0d075","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--1b276f98-31ec-5e08-bd63-16ebfc0b184d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--1fb811fa-49d4-5cc1-9894-1b2333b3c408","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Network Sniffing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1040","url":"https://attack.mitre.org/techniques/T1040"}]},{"type":"relationship","id":"relationship--36f129d4-44b0-535f-9705-2a86ceb0aa90","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--6256b7df-b3cd-571c-81f8-5cbbff847449","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--b6216ecb-2462-58c2-a03c-23a3c2130faa","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--b51b9f3b-ea0f-590c-b994-2cec6a4a6a18","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--ddb83342-6c50-5c99-bfc6-8182b6cee715","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--de833d00-1944-51ff-9882-630cc270b9bd","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--00d746a3-829a-5417-94c0-5284144585b2","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--54b706a3-8771-5444-b84c-1c77f15421c9","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--54049de0-bd7f-5641-b6ae-b5c8e5bcb5c6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Software Deployment Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1072","url":"https://attack.mitre.org/techniques/T1072"}]},{"type":"relationship","id":"relationship--72a4c0d1-db9e-5afc-87e5-90663adc145c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--51403e50-25c3-5cf1-ac4e-a15b197eaf6b","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--170ac054-879a-5b68-b5bf-4f0ae85868ab","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--0c5aea60-04e2-5f4f-84c6-9db336790684","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--2e0c300c-883f-5be2-ad5c-f7f6a265740c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--6cd7406d-40ec-5be3-a411-189a98d3ce0a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--77c38b8e-5c6b-5a44-92f5-47cc56b05300","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--7403696f-31dd-59d4-b8df-18bb30ebeeef","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--71218c51-843e-59a2-9bf1-dbda636c375e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--2d5ce9c2-59cc-5778-bb5f-b1073d29eac8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--343c0739-380d-510b-9281-106ba73f460a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Supply Chain Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195","url":"https://attack.mitre.org/techniques/T1195"}]},{"type":"relationship","id":"relationship--5398ed0f-c954-50c2-8cdf-306e74cead01","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--343c0739-380d-510b-9281-106ba73f460a"},{"type":"attack-pattern","id":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Compromise Software Supply Chain","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195.002","url":"https://attack.mitre.org/techniques/T1195/002"}]},{"type":"relationship","id":"relationship--635663fe-2c5a-5b8f-b734-7cc4ce20db42","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--6c80fc38-96bc-58b9-af94-f7ff36eb41bf","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--435493f6-4e9e-5138-ae06-a6574546fdc5","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--079a2fba-4961-58ba-b9aa-33c12fd7d011","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--20dd0dfd-414b-5254-9d1e-057b4447a9c8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Remote Access Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219","url":"https://attack.mitre.org/techniques/T1219"}]},{"type":"relationship","id":"relationship--151f73ca-50f3-5bed-a787-2c128ac77df3","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7"},{"type":"attack-pattern","id":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Data Destruction","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1485","url":"https://attack.mitre.org/techniques/T1485"}]},{"type":"relationship","id":"relationship--9a3d6d35-1cda-58c1-a5dc-740e33317009","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--9d2bd675-9d05-5b2b-8364-8208a3bf4b7d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Service Stop","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1489","url":"https://attack.mitre.org/techniques/T1489"}]},{"type":"relationship","id":"relationship--e4c8fbac-e36e-51f9-b61e-50479dc827d1","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256"},{"type":"attack-pattern","id":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Inhibit System Recovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1490","url":"https://attack.mitre.org/techniques/T1490"}]},{"type":"relationship","id":"relationship--a3bb1617-c934-5ceb-aee5-a14865658994","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117"},{"type":"attack-pattern","id":"attack-pattern--c26d9a70-f68f-5fe4-9bf9-0e39b9ede524","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Endpoint Denial of Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1499","url":"https://attack.mitre.org/techniques/T1499"}]},{"type":"relationship","id":"relationship--5dfcb876-030e-5ac0-b31e-871a02cf1f90","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--c26d9a70-f68f-5fe4-9bf9-0e39b9ede524"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--b0dc9d46-8ec3-54d2-9d41-6bed533b6a8d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Disk Structure Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.002","url":"https://attack.mitre.org/techniques/T1561/002"}]},{"type":"relationship","id":"relationship--ddd21e28-e018-5db8-b004-be9a45dacbd2","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--b859c0f0-0a80-5b1b-b596-3d9e5a551613","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--aa0accb6-aa57-56ff-b232-c024306492bf","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--1c78c9a4-13bf-5d5e-92ac-b49ba1da71ee","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--a499ff41-25a7-528c-a130-a1b0f51ddc33","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Acquire Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583","url":"https://attack.mitre.org/techniques/T1583"}]},{"type":"relationship","id":"relationship--d0c5756c-e028-54ed-baa8-b4218ba4e148","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b"},{"type":"attack-pattern","id":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.004","url":"https://attack.mitre.org/techniques/T1583/004"}]},{"type":"relationship","id":"relationship--fd739204-86f9-586c-b01e-dff2319ffa99","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--2e840d87-73f5-514d-bf16-9d51442b14e0","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--16e01e82-89cb-5500-a68a-e8fdf676a949","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Employee Names","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.003","url":"https://attack.mitre.org/techniques/T1589/003"}]},{"type":"relationship","id":"relationship--748e17d3-6a5f-533f-a942-15e910d84c8c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--16e01e82-89cb-5500-a68a-e8fdf676a949"},{"type":"attack-pattern","id":"attack-pattern--ebcbdfd8-df54-5540-89c2-6a48b361b04d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Domain Properties","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1590.001","url":"https://attack.mitre.org/techniques/T1590/001"}]},{"type":"relationship","id":"relationship--263b000f-1d57-5b8c-ba40-9d68bfe15860","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--ebcbdfd8-df54-5540-89c2-6a48b361b04d"},{"type":"attack-pattern","id":"attack-pattern--73f95eab-a03c-580b-a3f4-612c5f9bf052","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1592.002","url":"https://attack.mitre.org/techniques/T1592/002"}]},{"type":"relationship","id":"relationship--1a69cc9f-4435-519e-a377-22977db5f20e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--73f95eab-a03c-580b-a3f4-612c5f9bf052"},{"type":"attack-pattern","id":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Search Open Websites/Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1593","url":"https://attack.mitre.org/techniques/T1593"}]},{"type":"relationship","id":"relationship--fcc31912-7a42-50a9-b7be-624af8f6cf23","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e"},{"type":"attack-pattern","id":"attack-pattern--d403a61c-7938-5d1b-ac03-e6cefd030168","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Search Victim-Owned Websites","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1594","url":"https://attack.mitre.org/techniques/T1594"}]},{"type":"relationship","id":"relationship--a13ff00c-a417-5475-a87d-8e4756c3be68","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"uses","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"attack-pattern--d403a61c-7938-5d1b-ac03-e6cefd030168"},{"type":"location","id":"location--c03e7817-436c-5fc0-97bd-dc7634cdae3c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Angola","country":"AO","region":"africa"},{"type":"relationship","id":"relationship--f4b7cb14-79de-5ae2-b387-ae288f78ef2f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--c03e7817-436c-5fc0-97bd-dc7634cdae3c"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--aee5e149-5e7a-53fc-a776-fc8171baa7e8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--28dababf-fcc7-58ed-ae24-1d60a7b62dd6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--8c176808-7b2f-5f84-8da7-afd784257bed","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Bulgaria","country":"BG","region":"europe"},{"type":"relationship","id":"relationship--b119a054-6471-5bd1-8663-b01351c55789","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--8c176808-7b2f-5f84-8da7-afd784257bed"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--23cdae08-eae8-5298-b3d9-eb42e71758f2","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--e7ed6485-7225-56a1-a7a7-badef4a98fe6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--78901b06-4d98-5534-90e9-1088ae5482cb","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--5e17e3ec-a28a-59a1-a7e7-4d2818a7383f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--828ed042-bbac-5697-b691-900d70b99f63","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--e467dd4b-d538-5a30-9bc0-3c22fb8d1f91","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--d02111f6-34ac-58f8-8414-e4fca5d9490d","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--17275d4d-e473-5083-876e-2dc69221f9b8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Georgia","country":"GE","region":"asia"},{"type":"relationship","id":"relationship--1237c169-f93a-5f44-95bb-c9b9227f4cf9","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--17275d4d-e473-5083-876e-2dc69221f9b8"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--cd80c66d-aebb-559e-bf94-14c351a29a1c","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--443e959a-5801-51e5-8847-17af3aa069d3","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--a679b65e-320e-5ad5-b7c7-a7c8176fda23","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--2b4aac14-5f2b-588e-b45d-9e167e07bba8","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--c05ad066-0c66-5303-a934-3eff70697d91","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--a10f98bc-e817-5f2b-b1e9-2a45e89d1490","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"New Zealand","country":"NZ","region":"oceania"},{"type":"relationship","id":"relationship--47670fdb-b470-5a13-8d37-e02c5d2eaace","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--60c5039b-54e0-5c84-b2fb-a067a5a966ea","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--0db3cf08-ca55-5b47-b22a-79ed1f512580","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--5335c49c-6927-5649-8a2c-06f868a6e189","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Slovakia","country":"SK","region":"europe"},{"type":"relationship","id":"relationship--768c25db-1bc8-52db-ab0a-956f5366a92e","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--5335c49c-6927-5649-8a2c-06f868a6e189"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--0ffc76cd-7368-5660-9b03-e640b3c6ef7f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--f29fc940-6748-5332-af5e-ff5e653619a3","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--b0a425fa-c156-5c27-b891-94798b9be545","spec_version":"2.1","created":"2026-05-20T09:50:18.366961+00:00","modified":"2026-07-29T07:05:42.966+00:00","relationship_type":"targets","source_ref":"intrusion-set--f40e41e0-b5a8-5ea7-a740-1e7b4f772b13","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}