{"type":"bundle","id":"bundle--468ca265-a9e8-5af2-a499-586a41c8888d","objects":[{"type":"intrusion-set","id":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"FIN13","aliases":["Elephant Beetle","SARDONIC BEETLE"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin13"}],"labels":["cybercrime","fin"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--aca1be1c-af7a-5cd6-b920-7c7e57a02ef0","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--2b23f2b7-c7fa-55f3-8428-c7f9d47c95d1","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--45cb3218-a06d-571a-ae31-3e140e786585","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--e99037a2-7970-5c75-bc6d-dd464f4408f7","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--e29faf03-da66-5d72-9054-bce1ee259b41","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--cec036bd-ec68-515f-ba18-179d674a61d7","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--f838e282-1155-5286-9840-4b79bc25e1b4","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--fa75b509-72c4-53da-b261-cd31bccdb08a","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--4a2ebb16-fd07-501b-988e-a8f0c19b6d03","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Windows Remote Management","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.006","url":"https://attack.mitre.org/techniques/T1021/006"}]},{"type":"relationship","id":"relationship--254fdf93-a41f-53e9-9e3c-3425ee8ca9fa","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--4a2ebb16-fd07-501b-988e-a8f0c19b6d03"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--f94183cd-8680-55dc-8fe9-a00e6c268786","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--d3f021f4-563a-52d8-a939-ed39c4ecc7ed","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--db99f05c-c541-53d5-b79e-3364e433221d","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--c7380178-5950-5e5d-a310-2451f6e79d45","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--a5125113-a4c8-598b-a32c-8f56c3625860","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--c88c7392-aaaf-5cf4-ad32-44c2ebc6b64e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--58a2c20d-88d5-5dd6-943a-3fa0036d8778","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--03a95dfe-177a-5015-a12a-8c4164e03f0e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--0cd3fb64-e080-50a9-912a-bdb52faa3040","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--31666fec-77cb-5651-b195-07273471a023","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--6b72da7f-9e43-5166-a48e-dee667d23fa7","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--18952d6f-46a9-5ffd-a480-2657446f7a7a","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--84a467ef-50f1-51c9-9054-bb4699800365","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Account Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1087","url":"https://attack.mitre.org/techniques/T1087"}]},{"type":"relationship","id":"relationship--bcf6fc4d-230e-585a-8029-fc34d1e539b4","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--84a467ef-50f1-51c9-9054-bb4699800365"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--87943997-0abd-5043-8d0d-56d4138ea67d","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--d6d363bb-1e9f-5f2d-937c-365af4c86aec","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--9d383618-f20b-5b59-a218-015d679ce131","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--2f6afacc-079b-5aff-beb8-17d39543134e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--83920c61-d692-51d4-afaa-ceb5f4068e1a","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--2003f16e-cd24-5cee-9762-75478b493838","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Pass the Hash","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.002","url":"https://attack.mitre.org/techniques/T1550/002"}]},{"type":"relationship","id":"relationship--6a4205d7-12d1-57c2-9820-531d11c7f687","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--aa24bca7-6cb2-5f0e-8987-3243a949a55e"},{"type":"attack-pattern","id":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Credentials In Files","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.001","url":"https://attack.mitre.org/techniques/T1552/001"}]},{"type":"relationship","id":"relationship--5c1dcfd7-4f52-5dfb-a277-e6bbd6d3dff1","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3"},{"type":"attack-pattern","id":"attack-pattern--daa55520-6984-56de-8036-33b693578bad","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Modify Authentication Process","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1556","url":"https://attack.mitre.org/techniques/T1556"}]},{"type":"relationship","id":"relationship--b10e7c9a-5bb3-5cac-86e5-4f7ad0f9a5d4","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--daa55520-6984-56de-8036-33b693578bad"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--97b925fc-7eb7-5c00-b507-bcfabbc11bcf","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--a05a9114-b900-5afa-a309-3f1038d16b68","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--73ec23f5-e347-53a5-ac6e-95c8fcdb8d7e","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Data Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1565","url":"https://attack.mitre.org/techniques/T1565"}]},{"type":"relationship","id":"relationship--f6a7543d-6359-51fd-8ec8-bb198e048a89","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--73ec23f5-e347-53a5-ac6e-95c8fcdb8d7e"},{"type":"attack-pattern","id":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Financial Theft","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1657","url":"https://attack.mitre.org/techniques/T1657"}]},{"type":"relationship","id":"relationship--76a81a8e-1b38-546a-9d3c-4456436c7867","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"uses","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--3f3ed482-67a8-59c0-aa1d-15b9dc915a29","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"targets","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--b1e221e2-ca95-550c-afe5-63d1b96fbc94","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"targets","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--65f9d1ed-f890-5422-9b80-26fc28964f39","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"Mexico","country":"MX","region":"americas"},{"type":"relationship","id":"relationship--7ba80c88-bffc-54b8-9059-1d6e40afc26b","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"targets","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"location--65f9d1ed-f890-5422-9b80-26fc28964f39"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--cade014e-da74-5f89-bded-d93359ecf012","spec_version":"2.1","created":"2026-05-20T09:50:22.461882+00:00","modified":"2026-07-28T19:46:02.143+00:00","relationship_type":"targets","source_ref":"intrusion-set--d9b66284-7d2a-52e1-92ed-42ffe546c411","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}