{"type":"bundle","id":"bundle--cbe81a15-9214-5aeb-8597-64bc9d9833e7","objects":[{"type":"intrusion-set","id":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"FIN6","aliases":["ITG08","MageCart Group 6","TAAL","Skeleton Spider","Camouflage Tempest","G0037","GOLD FRANKLIN"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin6"},{"source_name":"mitre-attack","external_id":"G0037","url":"https://attack.mitre.org/groups/G0037/"}],"labels":["cybercrime","fin"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--55e78908-e219-5709-abb3-f53fd152f424","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--75962b30-3d39-5e64-b5a1-a10db981035d","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--9baa20bb-0e99-5ff8-8325-d12d1a0e9e11","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Archive via Custom Method","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.003","url":"https://attack.mitre.org/techniques/T1560/003"}]},{"type":"relationship","id":"relationship--e418925e-6dcf-5abc-966e-54e4d9b188a6","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--37a997f0-3874-5ab5-976b-8e6c50f267f7","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--796b7fab-7621-5cb6-970d-05afc6d09608","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--ba1b3886-7a67-59a1-b068-c3368b268454","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--f6e55980-cbfd-51b9-ac92-409811d5640b","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--d029da23-fb07-5bf7-865d-cbc8f1beeb3a","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--e271ae2e-5a77-5df0-a8e4-10bbde13beca","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--31eea41c-f456-5115-a230-7f06952a296e","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--646a2e3d-013f-53e9-8903-c59c1f6dfaae","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--24a62051-e743-506b-b866-6a0267dfd16c","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--832bce6a-9506-587f-a8ca-cca466f8979b","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--c8119243-687c-54a4-aaff-9ceac564a4df","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--b821ec42-707e-5175-b552-40f7c9227ebb","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--4c33fe09-8390-5095-894c-4221ce79b642","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--1508d2f3-13c6-560e-93ff-598a5b19e1bf","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--a0289deb-ef5c-539c-9ab8-d371b3ca46ed","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--e56bd704-51a9-5794-988f-e852b8a97e99","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--65cfc09d-d86f-5763-9e68-33c3b16c1fba","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"attack-pattern","id":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Asymmetric Cryptography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573.002","url":"https://attack.mitre.org/techniques/T1573/002"}]},{"type":"relationship","id":"relationship--8015cdad-71eb-5760-a217-ba723d68688c","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--742074fc-98b9-5940-ba76-5c316664cac1","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--4d9979dd-0a17-5dd3-9523-8bd12ab53bd1","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--d30f7848-e2f6-5650-b22f-3b3968982dcb","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--684e28ca-79c7-5897-9dc8-885c84e1ed79","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--03a5a5a3-282c-5fae-9313-72571f6837c5","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--fc305a51-ea42-516f-8214-b8b5a27e2ceb","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--cd5fa483-3558-51d4-96f4-3b3afd54828c","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Access Token Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1134","url":"https://attack.mitre.org/techniques/T1134"}]},{"type":"relationship","id":"relationship--ed1a240f-74fb-5c88-a45a-77458ae1b812","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--cd5fa483-3558-51d4-96f4-3b3afd54828c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--715e87be-bbd8-5b49-9a71-77f7acd70080","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--783565bb-cb38-57cc-a304-9220bb204b97","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"uses","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--90addd59-2111-5b10-b5c1-ae502404e859","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--ebec6d4d-2339-599f-a4a2-c91a51ef9304","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--81f07cc7-1425-5946-9999-0b2a9425cdbe","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--2c53bc29-036c-5030-9451-c1dd6089d6e4","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--e1e05c3f-2e49-5784-840a-d573666440a8","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--986890e6-c223-538d-88a6-4a268001e23b","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--8f81c488-7ae1-5730-bc2c-7e1016423b79","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--c949b175-ab55-5e14-a105-dc8c7e28e2ad","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Ireland","country":"IE","region":"europe"},{"type":"relationship","id":"relationship--c17d19b1-a98b-52a3-bfa3-37cba46a7748","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--a3968807-c8f3-5a1f-b045-5fdd4ccfa052","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--b99b7ca3-49ee-573f-a1fb-879b3f86d238","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--d68d3082-0a82-54b3-b385-11d17d3f60c6","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--932f4274-7c10-5050-811f-87042a0c733f","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--6ec83b80-2fda-5da2-b111-82f6e896f785","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--8827554e-7002-558c-8fc5-66b4d2fbf246","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","name":"British Virgin Islands","country":"VG","region":"americas"},{"type":"relationship","id":"relationship--a9bebfda-5ef8-53b2-883e-96bc0f404e42","spec_version":"2.1","created":"2026-05-20T09:50:20.897701+00:00","modified":"2026-07-29T08:55:06.546+00:00","relationship_type":"targets","source_ref":"intrusion-set--4f7b2914-fceb-5742-bb86-791f9d0d4e98","target_ref":"location--8827554e-7002-558c-8fc5-66b4d2fbf246"}]}