{"type":"bundle","id":"bundle--307cea79-d192-5d10-b62a-9e44f3d878e1","objects":[{"type":"intrusion-set","id":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"FIN7","aliases":["ELBRUS","ITG14","Calcium","CARBON SPIDER","Carbanak","Sangria Tempest","G0046","GOLD NIAGARA"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin7"},{"source_name":"mitre-attack","external_id":"G0046","url":"https://attack.mitre.org/groups/G0046/"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--4fc58c79-32a3-530f-a75c-3297cb9e1314","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Fallback Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1008","url":"https://attack.mitre.org/techniques/T1008"}]},{"type":"relationship","id":"relationship--bec04fc3-011a-5d67-b641-4c401bde0d66","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--c9b54e3d-ea19-5b81-8d3f-a6702d56d6b0","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--c4020f52-040a-58b8-9a2a-4a9b3560d171","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--532c871e-cd45-5b9d-b5e4-c891c06bdda8","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"VNC","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.005","url":"https://attack.mitre.org/techniques/T1021/005"}]},{"type":"relationship","id":"relationship--f93b3565-2dca-502d-927b-22e356011267","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--532c871e-cd45-5b9d-b5e4-c891c06bdda8"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--9b08261c-58bf-5f90-81e0-ff7be2833172","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--2ac61398-f915-598d-84be-3e126fe0d5b4","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--ed5b2adb-0a56-564b-9834-526b762e399c","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--eb1af065-06cf-5588-b9a9-01f17c55170f","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--577307fa-2a7c-583c-8307-dd5e30d6b03d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--efa47bdd-59a9-529c-8e54-c1a2c709f8a1","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--8000c3eb-4a27-5a18-bc0e-eb8d6fc25265","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--15c3c60d-061b-574b-b051-22c40dbed990","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--da539551-3da0-5626-9643-0c4b41d5148d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--c2131d5a-d35d-54ba-a3c5-90ce66180807","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--d3563936-6f84-5eb6-b425-4dac179fbf43","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--877bb330-967d-5a47-a9f6-884c23a184af","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--163905bb-5b86-5084-b7a3-9486c09a9e22","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--1e61e657-e76a-5b44-81eb-d692a39ce5d6","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--b5bee481-05ea-58bb-bfd1-551f73de7758","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"attack-pattern","id":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Replication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1091","url":"https://attack.mitre.org/techniques/T1091"}]},{"type":"relationship","id":"relationship--554c99a7-11a7-5f77-ac86-95428cef7e0e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--09dbab44-1890-58b4-8cb3-8151161af555","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--dff63f65-369a-58b8-a09b-3efae4918815","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--d0258f6a-ce0f-5abe-b87f-a5bb08e99be7","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--d9586472-ab83-5423-a634-e6af881c8aed","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--319ae6fa-5af4-59f5-ba87-b8610822ef7e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Video Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1125","url":"https://attack.mitre.org/techniques/T1125"}]},{"type":"relationship","id":"relationship--c9d52f86-06d8-5811-b9b8-5b3e344814a5","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--319ae6fa-5af4-59f5-ba87-b8610822ef7e"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--591bb522-74fa-503a-9aca-8b149b47d841","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--5111a12f-a65d-5147-842c-70a5354942f0","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Compromise Software Supply Chain","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1195.002","url":"https://attack.mitre.org/techniques/T1195/002"}]},{"type":"relationship","id":"relationship--07e50159-cec9-5dae-993f-5e74e89e78cb","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--71223944-8294-53c8-b3d3-106d6c5aac70"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--49174a0b-bbbf-50fd-a5db-8931922b08cf","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--1e0ed233-b598-5907-b268-c0eb0cc9edc4","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--202e81a2-7598-5ce0-b425-ce7f7fce5472","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--eea99ff5-3225-5343-a08e-f2da7afd6cd7","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Remote Access Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219","url":"https://attack.mitre.org/techniques/T1219"}]},{"type":"relationship","id":"relationship--d174c2a7-5228-5b7c-a3fa-f0a045b98aea","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--1efb551d-882c-538f-8eed-5cfdfac317e7"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--b00eb182-16a3-57d0-97f9-5453bd932205","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--63cd96f8-cfce-5de8-8fee-6637dc27bc32","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"User Activity Based Checks","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1497.002","url":"https://attack.mitre.org/techniques/T1497/002"}]},{"type":"relationship","id":"relationship--7f11f3af-c448-5bce-9d38-915bb9ffe972","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--63cd96f8-cfce-5de8-8fee-6637dc27bc32"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--d4464089-25b2-5530-bab8-b3f6e2d159b2","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--3b13c972-657a-546d-a04d-ba0916382c73","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--a9145f76-158d-5d43-bab3-230f71d937ae","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Kerberoasting","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1558.003","url":"https://attack.mitre.org/techniques/T1558/003"}]},{"type":"relationship","id":"relationship--8fa55167-9d72-5322-a5d9-0bf66a4e0d2e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--a9145f76-158d-5d43-bab3-230f71d937ae"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--db9b6bf1-a006-5e45-8752-af1018d180b5","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--68af0d39-5f1a-58a2-9eae-3a219f2b7795","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--ae987cc0-9250-5dd5-8db2-c350b68b5334","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--34386214-0da3-5cdf-a6b6-2a9d0699f54f","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--9064498a-7f9e-55ad-bc1d-e0070ba1a033","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--2a1c7185-a6a9-544e-beb0-0811e979a0d0","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--4ba6470a-788e-50e2-a05a-24d477bfb100","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Gather Victim Org Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591","url":"https://attack.mitre.org/techniques/T1591"}]},{"type":"relationship","id":"relationship--a0f9d221-4020-502f-bd6e-384e9d30319a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15"},{"type":"attack-pattern","id":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Identify Roles","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591.004","url":"https://attack.mitre.org/techniques/T1591/004"}]},{"type":"relationship","id":"relationship--18ef5d49-d8c6-5518-8040-0a9a1fbed07a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e"},{"type":"attack-pattern","id":"attack-pattern--424bd381-2391-595d-9c4c-898edb9c2444","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Link Target","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1608.005","url":"https://attack.mitre.org/techniques/T1608/005"}]},{"type":"relationship","id":"relationship--ca9f0a75-9df5-5957-8899-05a6ba707a06","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--424bd381-2391-595d-9c4c-898edb9c2444"},{"type":"attack-pattern","id":"attack-pattern--91082435-6499-50af-8289-66deab3c3048","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Reflective Code Loading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1620","url":"https://attack.mitre.org/techniques/T1620"}]},{"type":"relationship","id":"relationship--d935785a-b8cc-587a-9901-db6d6a210646","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--91082435-6499-50af-8289-66deab3c3048"},{"type":"attack-pattern","id":"attack-pattern--70023497-3ebd-5a53-97a1-c268c6601aed","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Input Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1674","url":"https://attack.mitre.org/techniques/T1674"}]},{"type":"relationship","id":"relationship--71ebed25-3988-5415-ab51-298ccb3afd38","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--70023497-3ebd-5a53-97a1-c268c6601aed"},{"type":"attack-pattern","id":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Disable or Modify System Firewall","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1686","url":"https://attack.mitre.org/techniques/T1686"}]},{"type":"relationship","id":"relationship--929f1da1-c55b-5a52-9155-0e84e36f5023","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"uses","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--7b6afba6-cf3e-5727-88c2-50288693bbf6","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--4ec61973-5456-5d46-8a64-c6bf41f8c8e6","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--49713136-beb2-5cc8-8f77-7ece3bba147d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--2da96e68-0c17-5052-9689-5f2c8850947a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--8c176808-7b2f-5f84-8da7-afd784257bed","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Bulgaria","country":"BG","region":"europe"},{"type":"relationship","id":"relationship--5071f5d9-3950-5b9d-8414-f7cb278c7e46","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--8c176808-7b2f-5f84-8da7-afd784257bed"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--e0f50473-6dbe-5484-913a-a3aedb96f8f3","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--6859eb7b-cb7b-5506-b3d6-7fe56878dd61","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--a302989d-b1c3-53c2-890a-3e336529da1b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--4a5069fe-25e6-586d-834e-c4723e81277a","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Czechia","country":"CZ","region":"europe"},{"type":"relationship","id":"relationship--ccc59992-b6e5-5f2a-a5ff-bc5dd9d27512","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--4a5069fe-25e6-586d-834e-c4723e81277a"},{"type":"location","id":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Egypt","country":"EG","region":"africa"},{"type":"relationship","id":"relationship--cc2a75e5-4ea4-5baf-ab64-939294c893fd","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--2945aaff-5905-5340-a9aa-e0d2c8067955","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--92918251-bfda-51fc-9dfb-7e233ba11812","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--9cc80d10-4fe5-5958-aaea-36a6dcfef122","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Greece","country":"GR","region":"europe"},{"type":"relationship","id":"relationship--17355a63-dfad-5d5e-b2cf-6a9f02971e5e","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--9cc80d10-4fe5-5958-aaea-36a6dcfef122"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--6fb4dd64-5b29-5c56-9857-d58f4709fe57","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Ireland","country":"IE","region":"europe"},{"type":"relationship","id":"relationship--c6683700-48ba-5cc8-93e3-942867a39ea7","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952"},{"type":"location","id":"location--999a2449-9639-5ace-8d27-777c4f47976b","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Jamaica","country":"JM","region":"americas"},{"type":"relationship","id":"relationship--97a7684b-a094-577d-b37c-384a0da95fdb","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--999a2449-9639-5ace-8d27-777c4f47976b"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--2fdac662-5a28-59bc-bdfe-be027f65d4e0","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--b6f60677-612f-52f0-8de0-e6c9176919e8","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--671536e6-945a-50d2-812e-660a03c3dd58","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Lebanon","country":"LB","region":"asia"},{"type":"relationship","id":"relationship--4a680cc5-d9ae-5928-a693-324f721c84f5","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--671536e6-945a-50d2-812e-660a03c3dd58"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--1ac01983-4a33-5056-b043-cad32f6230b2","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--3cd79224-9615-55ee-8547-35f3201b8c4c","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Qatar","country":"QA","region":"asia"},{"type":"relationship","id":"relationship--4c0da38e-0d74-5fc6-8e57-bbac846eb78d","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--3cd79224-9615-55ee-8547-35f3201b8c4c"},{"type":"location","id":"location--94b84d12-7dfb-58a3-beee-9675b5717b84","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Romania","country":"RO","region":"europe"},{"type":"relationship","id":"relationship--adab8ec5-acd9-5b23-8873-3c4be481da40","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--94b84d12-7dfb-58a3-beee-9675b5717b84"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--fb755bf6-0254-52b5-a070-85da7f04a580","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--380ebd09-66ba-5daa-9804-464ca5dd0071","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"Yemen","country":"YE","region":"asia"},{"type":"relationship","id":"relationship--2292e2af-425c-51e7-87c2-8516f934098f","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--380ebd09-66ba-5daa-9804-464ca5dd0071"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--f57f9e80-15b6-5bb1-8435-2675e065b1ce","spec_version":"2.1","created":"2026-05-20T09:50:21.145746+00:00","modified":"2026-07-29T07:06:22.53+00:00","relationship_type":"targets","source_ref":"intrusion-set--32dc8dd4-1489-54ce-8cf9-9a0a61285e5f","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}