{"type":"bundle","id":"bundle--62f80928-8a92-5d1a-aaa0-42371209570f","objects":[{"type":"intrusion-set","id":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Gamaredon Group","description":"FSB-attributed cyber group operating against Ukraine since 2013.","aliases":["Gamaredon Group","BlueAlpha","ACTINIUM","UAC-0010","WINTERFLOUNDER","Shuckworm","Trident Ursa","DEV-0157","Armageddon","PRIMITIVE BEAR","Gamaredon","UNC530","Aqua Blizzard","G0047","IRON TILDEN"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/gamaredon-group"},{"source_name":"mitre-attack","external_id":"G0047","url":"https://attack.mitre.org/groups/G0047/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--bebc6689-72a2-54ea-bd4f-a03da476244c","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Data Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1001","url":"https://attack.mitre.org/techniques/T1001"}]},{"type":"relationship","id":"relationship--5bf5212f-996e-5b21-abfd-76dca2d5d70f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--bebc6689-72a2-54ea-bd4f-a03da476244c"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--273f4908-d37a-5ac8-a424-cc0de73a6c7f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--0a11a8a3-5671-5988-84c6-9447aa463201","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--db4d6896-4f6b-5da4-b680-f07e2ddbd80e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Automated Exfiltration","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1020","url":"https://attack.mitre.org/techniques/T1020"}]},{"type":"relationship","id":"relationship--498b275a-8bb5-5cf0-af40-9bc065ec54d9","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--db4d6896-4f6b-5da4-b680-f07e2ddbd80e"},{"type":"attack-pattern","id":"attack-pattern--532c871e-cd45-5b9d-b5e4-c891c06bdda8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"VNC","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.005","url":"https://attack.mitre.org/techniques/T1021/005"}]},{"type":"relationship","id":"relationship--264411fc-f051-59b8-84f3-5347e4d0fc6b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--532c871e-cd45-5b9d-b5e4-c891c06bdda8"},{"type":"attack-pattern","id":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Data from Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1025","url":"https://attack.mitre.org/techniques/T1025"}]},{"type":"relationship","id":"relationship--e1fcfd43-507d-537f-a88e-099b1cc21fcc","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--8362092f-35a7-5eb4-b7f0-1e97b1f4e7f8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--395b60b6-33cc-55f0-b57a-c95930b08886","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Compile After Delivery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.004","url":"https://attack.mitre.org/techniques/T1027/004"}]},{"type":"relationship","id":"relationship--02a9f462-1f4b-5dfe-9b4f-d29fda6c867f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--395b60b6-33cc-55f0-b57a-c95930b08886"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--1bb52952-47b7-51f0-a34d-c5fef66e1b0f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Compression","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.015","url":"https://attack.mitre.org/techniques/T1027/015"}]},{"type":"relationship","id":"relationship--c0a18352-8516-5331-bb48-135469cbc047","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--b24ee32c-d8dd-5cf6-a4e5-95e1a2c3eec6","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--22b631ce-6a0f-5210-a2fb-f579ed59ae0f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Data from Network Shared Drive","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1039","url":"https://attack.mitre.org/techniques/T1039"}]},{"type":"relationship","id":"relationship--c5658b5e-cf65-5141-9b86-6041e4da8adf","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--1371929d-1341-5014-9597-ee60903663e8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--2989937d-b237-5812-9bcb-46ba723ca5de","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--3630b96a-3ba3-5aed-a122-26932bdef084","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Process Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055","url":"https://attack.mitre.org/techniques/T1055"}]},{"type":"relationship","id":"relationship--d01c85cd-1b69-5cc6-b3f5-0536a7b8d7c6","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--98267afe-6e5d-58e2-891e-ee2b94be12d8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--d8498a0f-1f77-575d-b0c1-36fcd96ac6d7","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--d7602098-8e24-5d7e-8078-a22c98d0cdb2","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--64292c75-309d-5556-9c4a-c1cda5a6f2a2","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--409b85d9-3a34-5a1d-904c-ce0d6b02111b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--abaf02e0-5a96-582d-a2cb-0a62dd63b635","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--f602a454-c6ed-5925-afc1-2ca4b0e72074","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Taint Shared Content","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1080","url":"https://attack.mitre.org/techniques/T1080"}]},{"type":"relationship","id":"relationship--5ebe40fc-7b75-5575-a2ce-da8caf395052","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--f602a454-c6ed-5925-afc1-2ca4b0e72074"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--125a4964-bc3b-594c-aa15-11d2ef5e52ad","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--d6afd5e9-11dd-5fc4-bcde-2db139658598","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--ade31e1f-d221-547c-9628-bdda0f54f14e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Replication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1091","url":"https://attack.mitre.org/techniques/T1091"}]},{"type":"relationship","id":"relationship--5e3f233f-cc20-588f-9fa1-fd98cb9d55a5","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--a4849660-9186-548b-9dba-c6ba4b3dcfdb","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--26f63914-b036-56b5-a273-87eec7cd4b22","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--e9ef761c-f453-594e-9b7b-e4af874360a2","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--8f6cd6af-2139-5895-ab2d-499acd2869b6","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"One-Way Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.003","url":"https://attack.mitre.org/techniques/T1102/003"}]},{"type":"relationship","id":"relationship--9ba81324-23bc-5b1c-8ebd-91027e215bc9","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--8f6cd6af-2139-5895-ab2d-499acd2869b6"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--2e7b37be-464e-5bee-b3d1-fe639fb1d862","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--61a964c9-d07d-5423-9a23-c86152576140","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--94862351-c210-528c-9ee3-9f50ab3afac6","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--219020c6-6c0b-5d68-bb0a-8803be869663","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--b5d274e2-44c9-5b72-9309-ccc26768568e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--732ce68d-08ce-5cf5-aa92-3c7b5c80d6b9","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--c00e51e1-2cb0-567f-a800-3fe86a08e29d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Office Application Startup","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137","url":"https://attack.mitre.org/techniques/T1137"}]},{"type":"relationship","id":"relationship--fdda94aa-40e6-5229-af1c-86e6ded5ecee","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--c00e51e1-2cb0-567f-a800-3fe86a08e29d"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--17a6f726-e1c4-5f2b-8f9f-1f2a713a58c3","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--722fe7be-2087-5a69-afdd-7530cac02f86","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--03245514-9345-56b1-b3fe-2b1587d23274","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--c226563c-edfc-575d-b566-1df944673a18","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Template Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1221","url":"https://attack.mitre.org/techniques/T1221"}]},{"type":"relationship","id":"relationship--4ab07b6b-fe74-57ec-9b10-fb2209d69ba8","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58"},{"type":"attack-pattern","id":"attack-pattern--7dea75b6-d963-5e0e-9f61-c7c9c2df6472","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Execution Guardrails","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1480","url":"https://attack.mitre.org/techniques/T1480"}]},{"type":"relationship","id":"relationship--9e368453-e6e8-5d8f-a182-4545338b58fa","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--7dea75b6-d963-5e0e-9f61-c7c9c2df6472"},{"type":"attack-pattern","id":"attack-pattern--63d8c962-180c-5950-9517-58314638d441","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Internal Spearphishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1534","url":"https://attack.mitre.org/techniques/T1534"}]},{"type":"relationship","id":"relationship--4a7a54a5-738e-5abc-a308-bae19e4cdf3e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--63d8c962-180c-5950-9517-58314638d441"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--00a1fbf1-9517-50c9-b580-b33bf3567bdd","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Disk Content Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.001","url":"https://attack.mitre.org/techniques/T1561/001"}]},{"type":"relationship","id":"relationship--53c17fd6-aae8-5d86-a1cd-dbd999745eeb","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--2e8cd43f-7236-5708-9a65-ed91c3d1199e","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--524d9388-b6c5-500c-b179-e6c64980fe15","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Dynamic Resolution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1568","url":"https://attack.mitre.org/techniques/T1568"}]},{"type":"relationship","id":"relationship--d835cd52-ecb9-575e-982f-112b96a8b635","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--21e5f410-ec62-53e5-897c-3973b413ca0f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--3d2ed31a-91b4-5323-bfde-2050388e59b1","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--774d007f-f58f-5fd5-bdcd-17a8d22e5e58","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--91082435-6499-50af-8289-66deab3c3048","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Reflective Code Loading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1620","url":"https://attack.mitre.org/techniques/T1620"}]},{"type":"relationship","id":"relationship--2bda5170-acbe-579a-8926-4fa48470fe43","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--91082435-6499-50af-8289-66deab3c3048"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--7db31510-57b6-5611-8938-3cb0de846988","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"uses","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--61b7a906-61ce-57da-ad39-490c0cca0f72","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Lithuania","country":"LT","region":"europe"},{"type":"relationship","id":"relationship--92f47985-25d1-587e-b8ea-8d19f78a2355","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"targets","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"location--61b7a906-61ce-57da-ad39-490c0cca0f72"},{"type":"location","id":"location--0cc52679-69d5-51c5-b375-66358567c08b","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Latvia","country":"LV","region":"europe"},{"type":"relationship","id":"relationship--5fe6a94f-ef77-589c-8cc9-f31cbf935f7c","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"targets","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"location--0cc52679-69d5-51c5-b375-66358567c08b"},{"type":"location","id":"location--4a3653c4-7a2b-5a40-9a63-734758742b9c","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Moldova","country":"MD","region":"europe"},{"type":"relationship","id":"relationship--8808e122-357e-5a57-bb9c-2f8908b6e41d","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"targets","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"location--4a3653c4-7a2b-5a40-9a63-734758742b9c"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--1e63172d-83b7-51b0-a5d4-ed62f2acb52c","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"targets","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--d0c35f08-820d-56ae-b798-c37ca6988bdf","spec_version":"2.1","created":"2026-05-20T09:52:22.054715+00:00","modified":"2026-07-29T08:14:20.52+00:00","relationship_type":"targets","source_ref":"intrusion-set--415715db-2b14-5abf-b8be-57fd70448f8d","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"}]}