{"type":"bundle","id":"bundle--3df6ffd7-d706-5b28-9a41-1f5397e4eda0","objects":[{"type":"intrusion-set","id":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Tick","aliases":["Tick","Nian","REDBALDKNIGHT","STALKER PANDA","Perplexed Bunny","BRONZE BUTLER"],"first_seen":"2008-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/tick"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--1aa842e8-17f7-5405-af9b-e406ac02bab2","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--c56497c0-4a22-5220-9f79-78e970fe1b92","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--e8ad726a-6949-52ec-97a6-bb246a0630ac","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--9dd47381-716f-5672-8319-c19034035063","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--0f1f67c2-86c1-52a1-a711-062856fd86e3","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--31245f77-f16c-58b3-b78d-830cab9211e1","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--19b25059-65bd-56b5-997e-4e9286196787","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Right-to-Left Override","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.002","url":"https://attack.mitre.org/techniques/T1036/002"}]},{"type":"relationship","id":"relationship--763dd608-16b0-5488-b571-051a90ca1c3d","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--19b25059-65bd-56b5-997e-4e9286196787"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--219c186f-677c-55b0-acea-2fbf97653656","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Data from Network Shared Drive","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1039","url":"https://attack.mitre.org/techniques/T1039"}]},{"type":"relationship","id":"relationship--c24daba5-fdf8-5250-930e-112a5cb2bc5b","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--1a036ab4-01db-57be-839a-1db8fba7d986"},{"type":"attack-pattern","id":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"At","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.002","url":"https://attack.mitre.org/techniques/T1053/002"}]},{"type":"relationship","id":"relationship--1f1323ad-f445-5e31-b19e-18c0df3565ce","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--09444e94-c79b-5747-a4f9-db081319f6ea","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--de7dd72d-412f-5a8b-8b86-9cf1c38792c9","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--93e224ef-4b02-5756-898c-25c7e491c29a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--304e086b-89f9-5b87-a3be-cfaf2d75502a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--49694fca-175f-55ae-a8e1-790a1fa15305","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--16c9fe51-a1b8-583a-b525-f533fafe61c7","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--5cec77f2-8b1b-5c99-a8d9-39f8708f4908","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--f602a454-c6ed-5925-afc1-2ca4b0e72074","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Taint Shared Content","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1080","url":"https://attack.mitre.org/techniques/T1080"}]},{"type":"relationship","id":"relationship--4364a3bb-a192-58d3-9904-4e3647949d99","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--f602a454-c6ed-5925-afc1-2ca4b0e72074"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--759ecaf3-0c4f-5b9b-a156-4163bb33c309","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Dead Drop Resolver","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.001","url":"https://attack.mitre.org/techniques/T1102/001"}]},{"type":"relationship","id":"relationship--1377232f-6e45-557e-8de3-38fb049d4e66","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--98ad307e-816d-5466-914c-5a98ffbaf5b0","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--e4cd130a-6147-520f-808e-89427e62ab09","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--ec6d9641-9bab-5685-8c6d-9cda68c16565","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--4c7c2d79-c73a-57f6-ad50-0fddc7b14400","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--781a14c7-cb1f-5ea2-a777-035ed71833c2","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--5748d0c3-2faf-5951-ad2b-363ee95b872f","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--66149835-bb2f-5716-bf72-60fc80e5722d","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--3a2ba0c3-6021-5fc0-94cb-8af62fa80d8a","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Pass the Ticket","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.003","url":"https://attack.mitre.org/techniques/T1550/003"}]},{"type":"relationship","id":"relationship--5bee42e3-9993-553d-a83b-059f34720594","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--2342ff5e-e520-5714-bbbe-4ea28a1236b7","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--ca488892-91d2-5a4a-844c-6a307b997978","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--6cc41683-3b9d-5335-a9d7-28e6640e3d4e","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"uses","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--83e2fcc4-9371-53d9-b902-3d0a7b89d3d9","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"targets","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--a8a94045-1dd2-5a6f-b862-3ca4c492d1ab","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"targets","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--3953f46d-117f-5f4a-beb2-ee41164141dd","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"targets","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--4f078f13-cc81-5b92-adce-f9e578ef4d86","spec_version":"2.1","created":"2026-05-20T09:52:28.341123+00:00","modified":"2026-07-29T08:14:31.564+00:00","relationship_type":"targets","source_ref":"intrusion-set--f282cb71-82c1-53d4-a036-249d12508c5a","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}