{"type":"bundle","id":"bundle--fe0b800d-5657-5a68-8f27-4fea69b61fdb","objects":[{"type":"intrusion-set","id":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Tropic Trooper","aliases":["Tropic Trooper","Earth Centaur","KeyBoy","Pirate Panda","G0081"],"first_seen":"2011-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/tropic-trooper"},{"source_name":"mitre-attack","external_id":"G0081","url":"https://attack.mitre.org/groups/G0081/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--7a5a56b9-a3fb-51dc-b7a6-cd4510361103","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--a0439f5f-b017-5f13-b056-ce726dd88986","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--61054cbc-ea48-5ec2-abc1-d7a7471ae1c4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--4aa203ba-ae03-5cc7-ae2b-85d61fa16a8d","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Replication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1091","url":"https://attack.mitre.org/techniques/T1091"}]},{"type":"relationship","id":"relationship--9d4709d3-bd9e-5ab3-a533-3150780ead64","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b"},{"type":"attack-pattern","id":"attack-pattern--e2f0e673-a3df-5e37-8903-0f86393d9bd3","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Winlogon Helper DLL","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.004","url":"https://attack.mitre.org/techniques/T1547/004"}]},{"type":"relationship","id":"relationship--cf87eb2d-eb17-51ba-b881-d8fe37aab33e","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--e2f0e673-a3df-5e37-8903-0f86393d9bd3"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--73903052-7bbf-51f3-9bce-06f9413180e4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--e5592d81-cfb3-5d8f-9612-3390799c0b74","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--73ab015f-ac02-5716-ada8-61dd377674d6","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--5a7b6655-f3f4-5f66-b393-dccdb34a17b3","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--a2709243-b56a-507c-a117-75b5422e1239","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--f023d75f-17dc-54bb-9ff4-8896c8573d1f","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--db4d6896-4f6b-5da4-b680-f07e2ddbd80e","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Automated Exfiltration","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1020","url":"https://attack.mitre.org/techniques/T1020"}]},{"type":"relationship","id":"relationship--1406268d-91c2-5ceb-9415-ffc11daececd","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--db4d6896-4f6b-5da4-b680-f07e2ddbd80e"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--68bd4b3a-4e88-5208-aaa0-2db242d45504","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--ddc0f6f2-a233-5f29-9fab-fc5995ddeb88","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--74767551-342d-58f5-b0af-5058f5854e1c","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--095ef3d9-82be-5163-99d5-2527af626bda","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Dynamic-link Library Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.001","url":"https://attack.mitre.org/techniques/T1055/001"}]},{"type":"relationship","id":"relationship--91e91ea3-5b30-5f0f-903e-7e948aca1907","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80"},{"type":"attack-pattern","id":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Encrypted Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573","url":"https://attack.mitre.org/techniques/T1573"}]},{"type":"relationship","id":"relationship--13048136-8002-55fa-8959-986d2010dff2","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--f3335bed-751e-5000-a25f-47a05c7e2fc8","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Template Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1221","url":"https://attack.mitre.org/techniques/T1221"}]},{"type":"relationship","id":"relationship--0b3cbba8-9163-5dce-9528-3237bc11c531","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58"},{"type":"attack-pattern","id":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Asymmetric Cryptography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573.002","url":"https://attack.mitre.org/techniques/T1573/002"}]},{"type":"relationship","id":"relationship--7bb48413-2486-5708-bae6-2a210c8efbaf","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--aa7bea50-51e0-53e4-8000-afd3fd5f6a26","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--8267d891-185e-5150-b74e-5ee54b5cfe98","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--eb08cdba-b5ec-5c8e-9d96-6038e9e483f0","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--5832ed9c-1395-5ed4-9221-25f2350eefbd","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--2019e03b-c8c5-51db-8fcc-c810dc6b0887","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--ba1b1272-97e0-5cfa-a071-824e71523c9f","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--3465d1a2-4bb3-59e6-abc3-c3a7ee1a19dc","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--1ec475d9-a5c3-58b7-9d4e-17d8332a94bd","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--5692f90c-a7df-5b62-abfa-e655cb5cfcbd","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--a5839a84-5b56-5ecc-ac5a-24e4c7eec8a1","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"uses","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--b132b501-190b-5353-b910-aff52dc06fb6","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--5a2b16ef-a6e1-5034-9c46-c54f6c0c2ca5","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--7b716fd5-585b-5dec-a7e3-3fd04e40eaf2","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--bc8ecff3-5891-5241-a6cf-f50718b9d708","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--0ad32210-a603-5126-b967-d14ceb90559b","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--f94c3510-f8f1-5459-a072-3da85d25b6c8","spec_version":"2.1","created":"2026-05-20T09:52:29.101447+00:00","modified":"2026-07-29T07:07:12.239+00:00","relationship_type":"targets","source_ref":"intrusion-set--bb6c5a4a-b22e-5ddc-b830-ff37bb3a2572","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"}]}