{"type":"bundle","id":"bundle--45fc8a94-5ba4-5baf-9c31-b5dc7bb6b476","objects":[{"type":"intrusion-set","id":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Evil Corp","description":"Russian-speaking cybercriminal syndicate behind Dridex banking malware and ransomware.","aliases":["Evil Corp","DEV-0243","TA505 (overlap)","Dridex Gang","INDRIK SPIDER","FIN11","Manatee Tempest","G0119","TA505","GOLD DRAKE"],"first_seen":"2007-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/evil-corp"},{"source_name":"mitre-attack","external_id":"G0119","url":"https://attack.mitre.org/groups/G0119/"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--beb71699-7a6f-56ac-a5bd-9692843d869e","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Acquire Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583","url":"https://attack.mitre.org/techniques/T1583"}]},{"type":"relationship","id":"relationship--346230d0-e441-5785-839b-44cf90f95c41","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--8222d0ec-9477-5f96-917a-d8c93270b926","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--13e06ac5-f6a8-56af-828e-3167afb77e7f","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Password Managers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.005","url":"https://attack.mitre.org/techniques/T1555/005"}]},{"type":"relationship","id":"relationship--9b582eee-80f8-5cc4-a2a9-56a3c416eefc","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--12636fbc-05a4-577f-a6bd-d7fc4d7d4d24","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Service Stop","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1489","url":"https://attack.mitre.org/techniques/T1489"}]},{"type":"relationship","id":"relationship--c51dfb06-c494-5780-aa3e-d8a408e9e7d5","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256"},{"type":"attack-pattern","id":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Gather Victim Network Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1590","url":"https://attack.mitre.org/techniques/T1590"}]},{"type":"relationship","id":"relationship--9f07d89c-7182-5d64-af4d-4a76bc6c9c68","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--b02b3f2b-a295-5e2b-ada6-62146205fb46","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--2d41e08e-0d71-5968-a513-da1a147f1490","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--b6d4a60f-1ba1-5765-ada8-9d31213b8282","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--6fa57ce1-7032-589f-a3f4-d2c87c0f696e","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--4ab49651-b871-5268-acae-c840ec668e8c","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--032b70c0-26f9-5f80-8bbc-4eda313f8d14","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--255021db-4633-5465-b96a-1f15776cfbbc","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--8e57d48a-0f80-5229-965f-ed804d19fe79","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Credentials In Files","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.001","url":"https://attack.mitre.org/techniques/T1552/001"}]},{"type":"relationship","id":"relationship--1123e618-999f-5673-8a27-ebdebe59d092","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--94c6f0d2-3b44-588d-a0e9-ddc97fe245b5","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--245351c0-427c-571e-894e-8147a02d60f4","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--7c4f76fe-b97e-54b9-b4cc-fb87356ae795","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Create Account","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1136","url":"https://attack.mitre.org/techniques/T1136"}]},{"type":"relationship","id":"relationship--d6453cc1-9d82-51d6-a160-c171870927c4","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--7c4f76fe-b97e-54b9-b4cc-fb87356ae795"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--fa56b1d5-793a-5279-9635-25c499d741fe","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--fec87211-8527-5f7a-b52f-1bf6056665d0","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--8e2cc2f0-1806-5965-8eba-ffec1e44d0e7","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--5623a19c-2e78-5daa-be06-0843111bcf51","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--a9145f76-158d-5d43-bab3-230f71d937ae","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Kerberoasting","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1558.003","url":"https://attack.mitre.org/techniques/T1558/003"}]},{"type":"relationship","id":"relationship--75ad64b2-469d-57d5-8b60-2ac0d99ff816","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"uses","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"attack-pattern--a9145f76-158d-5d43-bab3-230f71d937ae"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--3e4f6aff-e20d-56bb-bd7e-3a3052e2e22d","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--bf79afc5-aff6-56b1-ba1b-d9b61234fa76","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--6de37333-9a52-5242-94f4-c9a70369ff66","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--f7a3a739-876f-513e-9bae-6baf4bf635b3","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--19ed7926-438e-566f-8720-132e1adc97f6","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--49016e31-6625-57bc-9825-fee2fdc3731a","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--8e95d179-792b-59c1-bdd6-e9a137cbff17","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--a9852269-7be9-5128-8507-dd593f49e075","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--fe09b0f4-6784-5651-9629-ff66df7656d2","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"New Zealand","country":"NZ","region":"oceania"},{"type":"relationship","id":"relationship--335f6d6c-f669-5e39-9841-feb4ac3252f0","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--b17b0f87-a2b2-5cbc-9207-359c4bf25d77","spec_version":"2.1","created":"2026-05-20T09:52:21.3043+00:00","modified":"2026-07-29T07:05:57.519+00:00","relationship_type":"targets","source_ref":"intrusion-set--6fa484f6-1eb6-5612-9e57-9c62ddc685f4","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}