{"type":"bundle","id":"bundle--6b3bc39b-3bb2-5af5-bea7-278415e7b8a8","objects":[{"type":"intrusion-set","id":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Turla","aliases":["Snake","Group 88","ATK13","Waterbug","Secret Blizzard","Uroburos","SUMMIT","KRYPTON","VENOMOUS BEAR","APT29","G0010","IRON HUNTER"],"first_seen":"2004-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/turla"},{"source_name":"mitre-attack","external_id":"G0010","url":"https://attack.mitre.org/groups/G0010/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--f42e9d5a-ee2c-50f4-9ddc-59d40d204316","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--c8b7b63d-0210-50a3-820b-3c3c01aa2e72","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"File/Path Exclusions","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.012","url":"https://attack.mitre.org/techniques/T1564/012"}]},{"type":"relationship","id":"relationship--38676968-792a-5dc2-b2e9-df482316f899","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--c8b7b63d-0210-50a3-820b-3c3c01aa2e72"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--fff491d6-9a46-5d90-9b4d-0ada62a5ec79","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--1c587310-0ff1-5475-98ba-3ae7d6ef3804","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Group Policy Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1615","url":"https://attack.mitre.org/techniques/T1615"}]},{"type":"relationship","id":"relationship--cc441d46-3225-513a-9443-19beb94a8f0b","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--1c587310-0ff1-5475-98ba-3ae7d6ef3804"},{"type":"attack-pattern","id":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Process Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055","url":"https://attack.mitre.org/techniques/T1055"}]},{"type":"relationship","id":"relationship--417c0316-3875-50bb-92e0-c09e53998848","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73"},{"type":"attack-pattern","id":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Mail Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.003","url":"https://attack.mitre.org/techniques/T1071/003"}]},{"type":"relationship","id":"relationship--c1198252-6df1-5473-bbb6-98cf6f6efc59","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--a7d57508-2890-525b-92d9-816e5255017e"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--cf6980c3-8d14-5ee1-9950-548901e820ed","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--337b2d14-54fc-511b-a8e3-220bb4072d9c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--4b044ae1-81bd-5f20-b797-c2bb6f458549","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Data from Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1025","url":"https://attack.mitre.org/techniques/T1025"}]},{"type":"relationship","id":"relationship--4a0c126a-226a-5093-b365-03cd01ba2c3a","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--53c47e21-ec08-55cf-832a-9c5a3f9d9297"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--706c5c4e-5c9f-5d84-aeb9-a5845d5db344","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--f5b22f2c-2ccf-5265-9952-dbdba9795141","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--e2f0e673-a3df-5e37-8903-0f86393d9bd3","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Winlogon Helper DLL","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.004","url":"https://attack.mitre.org/techniques/T1547/004"}]},{"type":"relationship","id":"relationship--575f5103-8c96-515a-8ead-cc6a45ccdd7c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--e2f0e673-a3df-5e37-8903-0f86393d9bd3"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--4d09a8a2-20c1-516f-8959-fa9bd4cd9570","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--814da65a-28ca-529c-a554-38b7aebb59f4","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Password Policy Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1201","url":"https://attack.mitre.org/techniques/T1201"}]},{"type":"relationship","id":"relationship--2ea5bf4e-7ded-5e7c-81f4-5a1723793ac7","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--814da65a-28ca-529c-a554-38b7aebb59f4"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--66bc563c-8415-5af6-ab7d-d31a6d7c67f9","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--3cc74ab2-91e6-5c74-af34-a4aef0ac183d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--227e4e54-5dd9-5e4e-96a5-69c0678a05bc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--75cf2107-f289-56be-861d-c7a9ea247295","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--a52a0673-aa8e-526a-b711-b59bdec07122","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--a8cfa8e4-3839-51d0-a4c0-ce46fafd011a","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--65cb85ce-dcf4-5eaf-bcf5-a0dfa0903882","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--6907b7d3-4690-5c64-846e-68172f879133","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--43e28257-c829-5875-bf78-33de78603bbb","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--24ba1640-05cc-50cc-a271-368723331776","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--90a47388-6e4e-5f8a-82b5-0992ee6a1973","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--8d51958b-e71f-503a-95be-625581466baf","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--4f8d2655-2831-5e89-9b0e-b196937c5fb2","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--e3d9eb6e-5dfe-59fa-8175-0e408e6b3188","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--8d8d4131-67e2-5c82-97e8-ed53f50534cd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--608108d9-e65b-50a2-a1c6-5b77be4b0640","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--1a0e2938-aafa-530a-ac10-916b016cf0b3","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--5d42ba3f-98e1-5ffa-a5b0-a7728217273e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Windows Credential Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.004","url":"https://attack.mitre.org/techniques/T1555/004"}]},{"type":"relationship","id":"relationship--9f8f2851-e73a-5787-9857-da04bc3b424a","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--5d42ba3f-98e1-5ffa-a5b0-a7728217273e"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--2edef314-df18-598e-8876-ac1732a337cf","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--7b7856d2-d669-5bb8-94bc-0f16897df14b","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Dynamic-link Library Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.001","url":"https://attack.mitre.org/techniques/T1055/001"}]},{"type":"relationship","id":"relationship--226fdc23-7cb1-579c-8efc-381013135b00","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80"},{"type":"attack-pattern","id":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Local Groups","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069.001","url":"https://attack.mitre.org/techniques/T1069/001"}]},{"type":"relationship","id":"relationship--59f57edb-1ce6-57a9-b661-f28a656d3215","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--644ed74f-d1d2-5628-a6f9-7249bce4a5cd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--97bd67c1-f300-52fa-b35b-9b05ad08e6a4","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--4fab8c49-3426-55ae-9d5e-eb9692e61e49","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--1e7abed3-61a6-55ed-a489-1547e11a57fc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--a8da9281-016a-5de5-a758-35ba13071699","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--2de12556-93c5-52fd-bd86-f7a294f0b1c5","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--5b48a41d-4850-5590-9da1-718dd7391f2f","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--5e69521d-b09a-5de1-b98c-37342683b642","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--2f95fdf3-c403-5ab9-8fc3-c1a2088e795d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--739076d9-68d5-5672-a084-138960a53601","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--8398dee6-b394-59a2-848f-2f5230749193","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--58b13715-1485-5270-a2a2-5bf179dfde68","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"uses","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"location","id":"location--ae85030d-69cb-536c-8f14-e4336359104d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Afghanistan","country":"AF","region":"asia"},{"type":"relationship","id":"relationship--d7e3fb20-41e3-51ec-bd2c-57f2738c2c45","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--ae85030d-69cb-536c-8f14-e4336359104d"},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--e1215d53-e4c4-5c69-b143-f65d2653c7f0","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--2dc3f4a3-2657-5ece-b0a5-64ca3987a3a3","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--14cc5d18-8a57-5e0f-88d5-6c2d26246041","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--111abc74-0f42-552a-aacb-b14296b370d1","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Belarus","country":"BY","region":"europe"},{"type":"relationship","id":"relationship--3896c0a9-26ae-5089-b3c8-f9a852bf7000","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69"},{"type":"location","id":"location--3735fb80-d9ff-58f3-9f1a-2d4e226b4843","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Cyprus","country":"CY","region":"europe"},{"type":"relationship","id":"relationship--1c073b8c-a37a-5140-a38c-2306bcc3fc36","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--3735fb80-d9ff-58f3-9f1a-2d4e226b4843"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--4e6cb895-75eb-55be-bc5f-2bb9cc8c4448","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--ef1a1d9d-8e86-587c-8ff6-3453366797fc","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--52de829e-b12e-5fb1-98a4-0863af08b935","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Estonia","country":"EE","region":"europe"},{"type":"relationship","id":"relationship--3ecb3c11-e5ee-569d-8021-be902c6e3b25","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--52de829e-b12e-5fb1-98a4-0863af08b935"},{"type":"location","id":"location--972e7358-1465-509f-837b-fd47d292f53d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Finland","country":"FI","region":"europe"},{"type":"relationship","id":"relationship--85025962-e3c4-577f-b7b0-daa12ef59165","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--972e7358-1465-509f-837b-fd47d292f53d"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--71ee66ec-b758-5b0f-be71-6a15754c12e3","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Hungary","country":"HU","region":"europe"},{"type":"relationship","id":"relationship--fcaf8e97-f8e7-51d6-9779-a162961eb967","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--a018f878-bdb0-5aa6-a919-5df22f59d981","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--6191aea2-8287-579c-b33a-22258b590363","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Jordan","country":"JO","region":"asia"},{"type":"relationship","id":"relationship--9394a8a9-2c4e-52a3-b707-cc5771a7f4cb","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--6191aea2-8287-579c-b33a-22258b590363"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--0cb665d8-e958-511d-8656-5e328697e2ea","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--dc2e5a0c-0da2-5edb-9335-bfa301d6eda6","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Montenegro","country":"ME","region":"europe"},{"type":"relationship","id":"relationship--f5ba28a2-669e-5396-b748-4e78ce10eea3","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--466150a3-5489-5d4d-9628-87da67478124","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--4fd5b528-4a01-5938-8137-134a367c37ca","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--94b84d12-7dfb-58a3-beee-9675b5717b84","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Romania","country":"RO","region":"europe"},{"type":"relationship","id":"relationship--2d190865-9c8c-5d43-ba81-306317145226","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--94b84d12-7dfb-58a3-beee-9675b5717b84"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--9bcabcab-537c-5800-a844-e07026f181c1","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--3663f9e8-a875-50be-9c75-55ce268ab497","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--a0a11d21-15eb-5ba3-8abf-55e5423ad340","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--c101610e-3c82-519e-8943-ba6bf39ac87e","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","name":"Uzbekistan","country":"UZ","region":"asia"},{"type":"relationship","id":"relationship--4ec93da5-ed0e-5561-b737-3f4e6c502d4d","spec_version":"2.1","created":"2026-05-20T09:52:29.354885+00:00","modified":"2026-07-29T07:07:15.545+00:00","relationship_type":"targets","source_ref":"intrusion-set--aaeb0bd7-30e3-5f66-8ec5-4be2a7a20731","target_ref":"location--c101610e-3c82-519e-8943-ba6bf39ac87e"}]}