{"type":"bundle","id":"bundle--c1b4b183-8304-5c16-94a9-295004407131","objects":[{"type":"intrusion-set","id":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"MuddyWater","description":"Iranian MOIS-affiliated cyber-espionage and disruption group.","aliases":["MuddyWater","STATIC KITTEN","MERCURY","Seedworm","ATK51","Earth Vetala","Boggy Serpens","ITG17","HELIX KITTEN","Temp.Zagros","Mango Sandstorm","G0069","TA450","COBALT ULSTER"],"first_seen":"2017-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/muddywater"},{"source_name":"mitre-attack","external_id":"G0069","url":"https://attack.mitre.org/groups/G0069/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--f44fd15d-63d2-5f00-bc80-400f3dbd8756","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--505496c7-5f06-5789-8448-f044ec5e587f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"LSA Secrets","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.004","url":"https://attack.mitre.org/techniques/T1003/004"}]},{"type":"relationship","id":"relationship--6e822fea-b59a-5d1a-889a-188c155aa83c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e"},{"type":"attack-pattern","id":"attack-pattern--d4d038b7-2005-5308-95a6-a4c470a4d947","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Cached Domain Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.005","url":"https://attack.mitre.org/techniques/T1003/005"}]},{"type":"relationship","id":"relationship--97ac5ca4-5eb2-5082-9f65-248008ad5677","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--d4d038b7-2005-5308-95a6-a4c470a4d947"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--505bb3b6-88de-5e54-9d29-b9cfc0362e16","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--d9242a9b-ad42-5c38-9470-d42f9d6e0873","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--dc747425-fe4a-5502-afbb-c10b3268345c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--395b60b6-33cc-55f0-b57a-c95930b08886","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Compile After Delivery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.004","url":"https://attack.mitre.org/techniques/T1027/004"}]},{"type":"relationship","id":"relationship--4d328235-a3f8-5194-a9c4-e478112a55d5","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--395b60b6-33cc-55f0-b57a-c95930b08886"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--8fe3f6b4-29d3-5f6c-9026-13dd2867bdb1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--1e0b0598-4d44-5209-9cd2-228314b6bd66","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--87463112-1bd8-5e99-bc64-0c4cb8ed6fa0","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--1436e9e6-c196-534a-bc65-5db1f5770f35","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--b69c0944-61fe-5f24-8b29-b6ffed3271cd","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--7dd76566-f5a1-58b7-9fcc-04ecfeba61da","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--322671b8-3d60-5bf4-8fb7-a1aca1785081","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--07f02028-f95b-542b-99f1-7f25e7c4a88d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--dbeff839-c0d7-51b5-9f30-3da053a62803","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--ccfdadb4-ad05-5c74-bd72-cdb39b95f97a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--72b29f0e-3297-5ca7-bbb0-b8d63c9231da","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--794448a8-1e25-534c-b65d-81097ea01a91","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--01eb937c-95c2-5fea-a26f-765b07e16490","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--b8fee311-acdc-500b-b7d8-845caf5377a7","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--7b735baf-ef44-5040-a5ae-7dce95b41874","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--70c1bf4f-2259-591e-ade2-42bc7fdfb65a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--5283fe86-c6cf-5bc9-8d85-6d0488249234","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--fa5e75eb-65ee-560c-a1a4-1da8dadb2134","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Multi-Stage Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1104","url":"https://attack.mitre.org/techniques/T1104"}]},{"type":"relationship","id":"relationship--eac16dff-6268-5443-9b26-fa2d48acf387","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--1ddd6cd4-a35b-5739-b23f-9d6b6677ddbd","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--0093d190-35c2-5fc0-9808-d291c565f730","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--c4a9eb8c-2e4a-502a-9112-5649363d15b0","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Office Template Macros","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137.001","url":"https://attack.mitre.org/techniques/T1137/001"}]},{"type":"relationship","id":"relationship--bbccbe06-bb7e-553b-8de5-922c516a853c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--c4a9eb8c-2e4a-502a-9112-5649363d15b0"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--3752998b-394c-5069-8209-f7806eb02497","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--24f00760-3ec9-5fa4-a419-1722b4d1f766","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--f9fe73f3-e344-51ff-ad24-e0514b751725","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--7947a342-6cf2-507c-abc6-4059edf1a0a3","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--26c38346-3efe-5223-a9e3-a96ac945f342","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Malicious Copy and Paste","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.004","url":"https://attack.mitre.org/techniques/T1204/004"}]},{"type":"relationship","id":"relationship--7db522d2-afb6-586d-8337-25e71b4d154f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--26c38346-3efe-5223-a9e3-a96ac945f342"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--acf124fe-2eaa-5e37-908a-2fa5f2479e7a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"System Binary Proxy Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218","url":"https://attack.mitre.org/techniques/T1218"}]},{"type":"relationship","id":"relationship--8597ad32-396a-517e-861b-db9a0900a5b1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d"},{"type":"attack-pattern","id":"attack-pattern--e37dea29-34ab-582e-bec3-d2ca1919b41f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"CMSTP","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.003","url":"https://attack.mitre.org/techniques/T1218/003"}]},{"type":"relationship","id":"relationship--f01ffa3b-e1b5-56ff-8505-1b43e36f1f9f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--e37dea29-34ab-582e-bec3-d2ca1919b41f"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--7e5bcd24-e4a9-5be5-8b0a-ee95fc5988ac","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--e3c39515-d009-588d-a63d-f920f1e5932f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Remote Desktop Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219.002","url":"https://attack.mitre.org/techniques/T1219/002"}]},{"type":"relationship","id":"relationship--b2e4e85b-f6be-52f1-afa3-c7d02dcd29b3","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--eda497bf-43c7-59a6-9cb7-4b745b030b2d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--63d8c962-180c-5950-9517-58314638d441","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Internal Spearphishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1534","url":"https://attack.mitre.org/techniques/T1534"}]},{"type":"relationship","id":"relationship--50890eca-f535-571e-8753-412a219a0ba1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--63d8c962-180c-5950-9517-58314638d441"},{"type":"attack-pattern","id":"attack-pattern--afc32c17-ef0e-54c3-87ea-a45a04363e95","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Boot or Logon Autostart Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547","url":"https://attack.mitre.org/techniques/T1547"}]},{"type":"relationship","id":"relationship--394b4816-9bee-5011-8a71-071412337be2","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--afc32c17-ef0e-54c3-87ea-a45a04363e95"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--441a0a55-8c6e-543d-b119-a0dd74acb730","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Credentials In Files","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.001","url":"https://attack.mitre.org/techniques/T1552/001"}]},{"type":"relationship","id":"relationship--1e668c58-820b-59bf-909f-620cd74c71c6","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--27a53a8e-e0c4-5263-bab8-35bf6abf58e3"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--1eabe1de-e2a7-5898-9f6d-4586ede2cd33","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--b220b230-ac03-51b1-95f0-774f627b871c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--6af22a69-3890-5e6d-a796-d02a2bea097c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--da8ab44b-1684-5a2e-8749-7a4e10d154de","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--b908d568-4286-5116-8eec-a1a48b6790ca","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--2bce38b4-3739-5736-a9dd-bc8e0517ca3e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--bed2b88d-3e9d-5604-9358-9d746ef4e4d5","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--1883781d-5942-5458-9336-a3433bb9a6f0","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--fd103e48-2b68-5b07-a2a9-0074e7f7f73e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--9a3afc04-8ef4-5e3e-a665-09b11ced462b","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--b876d62f-4f51-5b0e-b7b1-5b0907f4f8c5","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--334054a0-7bf7-5b00-9a2a-90011dedba7c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"uses","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--5f6a9fc5-0aca-5245-8861-3d3013cf220d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--ae85030d-69cb-536c-8f14-e4336359104d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Afghanistan","country":"AF","region":"asia"},{"type":"relationship","id":"relationship--1fd91c6b-039d-5dad-bd33-90dc15f834cb","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--ae85030d-69cb-536c-8f14-e4336359104d"},{"type":"location","id":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Albania","country":"AL","region":"europe"},{"type":"relationship","id":"relationship--8a3878cc-a13b-5653-b465-a0695a088961","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1"},{"type":"location","id":"location--26bd43ce-64de-567e-a36d-0f23691c63dc","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Armenia","country":"AM","region":"asia"},{"type":"relationship","id":"relationship--54e459c9-6da8-511a-bb6d-02d5582130a6","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--26bd43ce-64de-567e-a36d-0f23691c63dc"},{"type":"location","id":"location--2da3bb22-42f9-50db-8059-c3a0023f7317","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Azerbaijan","country":"AZ","region":"asia"},{"type":"relationship","id":"relationship--f1aa7a32-c36b-5eb9-8881-9e0241b1a2b9","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--2da3bb22-42f9-50db-8059-c3a0023f7317"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--9ae79908-021b-521f-85ea-ff712c48b6ed","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Egypt","country":"EG","region":"africa"},{"type":"relationship","id":"relationship--e3c5b452-785a-5f1e-b41d-3ca1abd02a9e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--769225cc-1b7f-5029-9fea-06b059c74aac","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--17275d4d-e473-5083-876e-2dc69221f9b8","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Georgia","country":"GE","region":"asia"},{"type":"relationship","id":"relationship--7d7ffa5b-13a0-502b-9d36-56b53703cf0a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--17275d4d-e473-5083-876e-2dc69221f9b8"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--e052437e-9b54-555f-9adf-5603528833c8","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--3b92379c-06bd-5311-96f6-38d5f7073ea3","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Iraq","country":"IQ","region":"asia"},{"type":"relationship","id":"relationship--47370725-a91a-5732-9855-a1a73ec97cf7","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80"},{"type":"location","id":"location--6191aea2-8287-579c-b33a-22258b590363","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Jordan","country":"JO","region":"asia"},{"type":"relationship","id":"relationship--781281e4-cf4b-5457-8a66-815381e228e9","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--6191aea2-8287-579c-b33a-22258b590363"},{"type":"location","id":"location--31bcf931-f4a9-50e8-8f97-7c650251c754","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Malta","country":"MT","region":"europe"},{"type":"relationship","id":"relationship--06396cc1-e34a-5224-a963-81cea854160f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--31bcf931-f4a9-50e8-8f97-7c650251c754"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--13cc4e5b-9e0f-50eb-9fd6-5cc24129321f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Oman","country":"OM","region":"asia"},{"type":"relationship","id":"relationship--a9637399-28d2-563e-a642-392ee543f85e","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--5f9b2d82-39c5-5557-9a34-0f741099c93f","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--a61fb05f-7ddc-53d3-8255-622cb23c19c1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Palestine","country":"PS","region":"asia"},{"type":"relationship","id":"relationship--06ff57e5-72b7-5879-8db0-8a5a945b74e1","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--a61fb05f-7ddc-53d3-8255-622cb23c19c1"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--62f250b9-7671-5269-8319-cb5ef939f258","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--dc8deb76-913b-5a5a-b1d1-2e04b6fd32bb","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Syria","country":"SY","region":"asia"},{"type":"relationship","id":"relationship--d4bacd44-d34e-5cb7-8678-b5fb594e5a81","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--dc8deb76-913b-5a5a-b1d1-2e04b6fd32bb"},{"type":"location","id":"location--24cc03c4-7725-5376-9bbd-18bc0da9c65c","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Tajikistan","country":"TJ","region":"asia"},{"type":"relationship","id":"relationship--f5c49d17-d4ad-50e3-a826-b18d70c2e138","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--24cc03c4-7725-5376-9bbd-18bc0da9c65c"},{"type":"location","id":"location--06f7de4f-637e-5ae2-9005-ad65adf38aac","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Tokelau","country":"TK","region":"oceania"},{"type":"relationship","id":"relationship--c8a12c9b-e801-5cda-b241-f97d07b2ecc8","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--06f7de4f-637e-5ae2-9005-ad65adf38aac"},{"type":"location","id":"location--ae6e2cd1-f570-5595-aec1-43d69c5dd77d","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Turkmenistan","country":"TM","region":"asia"},{"type":"relationship","id":"relationship--ec5fec5c-7033-5efe-b0ba-f5c212181b30","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--ae6e2cd1-f570-5595-aec1-43d69c5dd77d"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--e73f4396-8067-5171-b08a-e199fdbcfc64","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--fa00bf26-9f58-5bdf-95d0-322f524dc205","spec_version":"2.1","created":"2026-05-20T09:52:24.066964+00:00","modified":"2026-07-29T07:06:35.687+00:00","relationship_type":"targets","source_ref":"intrusion-set--547ded74-3536-5f07-b803-6255492c5960","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}