{"type":"bundle","id":"bundle--fd6e75cf-8774-52b8-8a6c-d5483b1284c5","objects":[{"type":"intrusion-set","id":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"HAFNIUM","description":"PRC cluster behind the 2021 Microsoft Exchange ProxyLogon mass exploitation.","aliases":["Silk Typhoon","DEV-0322","Operation Exchange Marauder","JUDGMENT PANDA","UNC3944","G0125","IRON TYPHOON"],"first_seen":"2017-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/hafnium"},{"source_name":"mitre-attack","external_id":"G0125","url":"https://attack.mitre.org/groups/G0125/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--a9b9ca64-adc7-54b3-baff-72fcdc52ea97","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--76c8e647-de90-5685-9fcb-5fd5e0ce2b8a","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Account Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098","url":"https://attack.mitre.org/techniques/T1098"}]},{"type":"relationship","id":"relationship--167e165c-f614-5a3f-ad02-43c40a72c085","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--dcf3ae78-5778-553a-bad8-dc96073e6561","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--65c9c03a-8e41-5d70-aaa9-c1f5b3168f9e","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--783bbffa-f777-52b0-a6de-3d906e10c5f9","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--b021eb33-fba7-5834-8166-939b5a23a569","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--da57ccdd-7dae-51e9-a640-0a274e5fe8e9","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--7078030f-857a-5c1e-9d3b-b245fb2d35fd","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--0a88e722-0934-5049-986d-132ff18dee89","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Gather Victim Network Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1590","url":"https://attack.mitre.org/techniques/T1590"}]},{"type":"relationship","id":"relationship--d2d14398-a9f6-578a-a38d-004b38ac80ef","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541"},{"type":"attack-pattern","id":"attack-pattern--85d825df-4452-5e3e-b072-985733591db3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Botnet","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.005","url":"https://attack.mitre.org/techniques/T1583/005"}]},{"type":"relationship","id":"relationship--761e8da3-5f77-5fe8-b193-7597b104feab","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--85d825df-4452-5e3e-b072-985733591db3"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--c0d57638-9e77-5e8f-b7c3-7c80cf386105","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--37ef4a35-a17e-5063-ba83-47cad1d50b7f","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--34065329-5f18-5968-92d7-fa833d2fb1ca","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--e22a61bb-0b1d-59d0-a297-8513cc8f43c2","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Client Configurations","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1592.004","url":"https://attack.mitre.org/techniques/T1592/004"}]},{"type":"relationship","id":"relationship--66eefa0f-6e90-5ae4-a854-73e1d4d72f14","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--e22a61bb-0b1d-59d0-a297-8513cc8f43c2"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--df913eef-564e-5d1f-aa17-fa3646698366","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--90406f06-a0eb-55f1-8c2b-331ca9995a3f","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Application Access Token","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.001","url":"https://attack.mitre.org/techniques/T1550/001"}]},{"type":"relationship","id":"relationship--f7a461a9-89fc-5da1-9f59-e2dfa70c3080","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--90406f06-a0eb-55f1-8c2b-331ca9995a3f"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--1a688832-d580-5671-9631-bd877dc8ea1b","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--fb1d1f76-7d34-5eb2-9031-d3f2d9868f93","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--b42aee49-5d86-56c1-8caf-ccaeedde3fd3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--b53ed546-1e47-55b9-ae99-a9d20151f6b3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--564c4b8b-9448-567c-a2e4-75f7169890b6","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--c9bd15fc-4a45-5b1f-93f6-70161ec46585","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--9d29ee47-130f-5065-a0b7-ec25c8d5dc9e","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--bf58b920-276a-522d-b241-511a6c3951ea","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Cloud Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.004","url":"https://attack.mitre.org/techniques/T1078/004"}]},{"type":"relationship","id":"relationship--d92ca448-c52b-568c-b01e-e4ef785aa2d1","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--22fc6583-f1b2-5803-a1cb-a46fd376762a","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--eed47737-21dc-54d3-85f2-df39b259bee0","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--8e163600-b4eb-5232-a904-f1861c81658b","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--11265f53-3882-5d09-8d11-548572fd7965","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Cloud Secrets Management Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.006","url":"https://attack.mitre.org/techniques/T1555/006"}]},{"type":"relationship","id":"relationship--1b1e2d9e-d70d-5dd0-a1fe-33db344dc7e3","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--11265f53-3882-5d09-8d11-548572fd7965"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--0a53d853-0b3b-53f9-aa26-cf05b653fee1","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--bec3d0e6-b5f6-58ff-a1f2-c70cddd77f77","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"uses","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--a6d0cb5d-88bf-5166-ab70-5c0549a507f7","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"targets","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--9d847703-30cf-51f9-9a51-ea19b7c7810f","spec_version":"2.1","created":"2026-05-20T09:52:22.302989+00:00","modified":"2026-07-29T08:59:15.588+00:00","relationship_type":"targets","source_ref":"intrusion-set--ac635491-65ee-590b-bb16-a8bafaeab2e3","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}