{"type":"bundle","id":"bundle--a5edee2b-c022-5ed7-9d0c-1683e8818e82","objects":[{"type":"intrusion-set","id":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Earth Lusca","aliases":["Earth Lusca","TAG-22","FISHMONGER","AQUATIC PANDA","UNC2478","Charcoal Typhoon","G1006","TA423","RedHotel"],"first_seen":"2019-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/earth-lusca"},{"source_name":"mitre-attack","external_id":"G1006","url":"https://attack.mitre.org/groups/G1006/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--e93289ab-cb52-574a-9120-adce08151358","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--1d28b215-1f72-520a-94b4-7b00bf8f635a","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--02cf34fc-5c27-50d7-aa3d-403be12a2569","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--1dbd47f5-92f6-5a0e-bf14-5defb16e07ee","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--082bc9ac-95b8-52b9-90f6-99592af34e46","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--61de1eab-8135-5fac-bab2-e5cd13189b56","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--e1f527c8-0719-5757-8201-b31c45911fd1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--7e467642-cf2b-5103-9670-fb706a0445d2","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.004","url":"https://attack.mitre.org/techniques/T1583/004"}]},{"type":"relationship","id":"relationship--24a0f0da-5ea1-5035-917b-4c145a2d0e71","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--a094715a-7dc0-57dd-8150-91345fc3be9e","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Domain Trust Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1482","url":"https://attack.mitre.org/techniques/T1482"}]},{"type":"relationship","id":"relationship--201a9ba2-8cae-5260-a341-84fa56f4ce3d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--a8354a12-3209-57f3-8f28-e98d13191883","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--441b63bf-6b09-5823-b9e1-9092575466b1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--acd03fb8-a91e-5632-aeef-3c1117f1d6f2","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--53c0bd32-3285-5cc3-a603-131176424f26","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Print Processors","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.012","url":"https://attack.mitre.org/techniques/T1547/012"}]},{"type":"relationship","id":"relationship--9932bb6e-5ee8-5890-a30d-bf2ceb1cef80","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--53c0bd32-3285-5cc3-a603-131176424f26"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--ab7c7246-2bfe-5257-90e1-2cfd953801f4","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--dd2acd22-7d41-5361-8b90-ecda564f7d10","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--c5e2253f-638e-52b7-a9a4-0a48a65c7706","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--55bb34dc-b48f-522c-a69c-216ef8a1a713","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--7c1b043f-71a7-51b1-bdb4-2b1971afc0d9","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--a063e773-fbab-5ed2-b199-813f77ec8643","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--65beaef0-f440-511b-8ebf-8145cefaa8d9","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--ba672258-e2aa-530e-b498-685fdde9ea23","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"DCSync","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.006","url":"https://attack.mitre.org/techniques/T1003/006"}]},{"type":"relationship","id":"relationship--b53839c4-d542-53b0-b22e-f6a7eba206f0","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--845ec073-4e40-5b49-9b0c-e992a572ac04","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--7ee5e311-b727-5317-b946-9d9bd25ef2fd","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--ca1bb3ef-063f-506e-8df3-8e2555a5edf3","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--58a0a954-f2bb-573f-ac77-bb574f43c4b0","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--5c2091b0-ea6a-593e-a592-8fbfbf1d6123","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--4afc478a-a3cb-5012-b418-ee86fde35fdb","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--4a3c5aa2-57b6-5d5e-a688-35df6e5f437d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--032237d4-1103-5a8e-8272-6764254da639","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--b8b01386-d726-5dee-ab1b-0dd372d8125f","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"uses","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--25d780bc-1f52-5d2a-a28f-6eee7c2f027f","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--714557a3-2b8b-5b97-a9db-15c3fc8a9ff1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Bhutan","country":"BT","region":"asia"},{"type":"relationship","id":"relationship--72f42c6a-1b1c-5676-9937-2c0f5069d5c8","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--714557a3-2b8b-5b97-a9db-15c3fc8a9ff1"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--5c254478-5c88-5482-90b9-84d770d40a36","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--a4fae2fb-3fc7-55df-855c-2dc7bb819628","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--40271613-8e67-5b62-88f7-03567be58fb6","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--372d5e3f-2720-5ce9-990f-d065a1cec05b","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--e2d8bb92-6449-5008-93b4-30a70b9ea8db","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--3eb78c6e-f756-589c-8ba3-b5a6ab1b0b58","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--d39516b9-2ecd-5ed5-a549-4d0ab4fba04b","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--2dd57ed5-2268-54ef-9f85-4fa4ac665df1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--c73c86b7-1ef0-5c45-900b-37fc95863c98","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--26b5e55d-9c86-5f7d-a35b-9b6db4d6678a","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--e524160a-fc29-565b-bc65-6a1bcba20d6d","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--814c2ddd-65d7-5ce0-ad3e-ebee85fdd8b0","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--eae5c1b5-24e8-5024-8c63-755d530685f3","spec_version":"2.1","created":"2026-05-20T09:52:20.520731+00:00","modified":"2026-07-28T19:55:00.028+00:00","relationship_type":"targets","source_ref":"intrusion-set--9bd44658-0242-55a3-aedc-314daf129a1b","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}