{"type":"bundle","id":"bundle--434efbc1-8048-5848-b97d-70c904428bb8","objects":[{"type":"intrusion-set","id":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"UNC3886","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/unc3886"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--577e6a0b-1b83-5146-9b11-c3686cff99e3","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Boot or Logon Initialization Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037","url":"https://attack.mitre.org/techniques/T1037"}]},{"type":"relationship","id":"relationship--1a98ff81-cbbc-5e49-9ed1-e51f69569337","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6"},{"type":"attack-pattern","id":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Archive via Custom Method","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.003","url":"https://attack.mitre.org/techniques/T1560/003"}]},{"type":"relationship","id":"relationship--aea1810e-7c98-54d8-82f3-b9a9cf5982e3","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714"},{"type":"attack-pattern","id":"attack-pattern--a9455e92-4b96-5927-9b93-759b0feb70ed","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Exploitation for Credential Access","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1212","url":"https://attack.mitre.org/techniques/T1212"}]},{"type":"relationship","id":"relationship--5e60fdb0-f2eb-5471-88a4-702e903d234a","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--a9455e92-4b96-5927-9b93-759b0feb70ed"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--5a0cf554-1396-56e3-86c2-0f560d3f89f4","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--845b5574-8835-593b-ab56-0c8ff18ea65e","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Traffic Signaling","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1205","url":"https://attack.mitre.org/techniques/T1205"}]},{"type":"relationship","id":"relationship--1e972a2a-2520-53ef-bfd8-7a771451b89c","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--845b5574-8835-593b-ab56-0c8ff18ea65e"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--a630f6a5-9b3d-5218-9fb2-7377410d23de","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Password Managers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.005","url":"https://attack.mitre.org/techniques/T1555/005"}]},{"type":"relationship","id":"relationship--ebcece87-6c14-5904-84e0-0c6a21fb8387","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58"},{"type":"attack-pattern","id":"attack-pattern--1d6a12a0-1112-5c41-af75-d32aec71fb0d","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Ignore Process Interrupts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.011","url":"https://attack.mitre.org/techniques/T1564/011"}]},{"type":"relationship","id":"relationship--6ba7d4bd-3de1-5f5c-9792-c74fb5db813d","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--1d6a12a0-1112-5c41-af75-d32aec71fb0d"},{"type":"attack-pattern","id":"attack-pattern--279e95a1-6442-5d7b-89de-9ba0f3cedbfc","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Search Threat Vendor Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1681","url":"https://attack.mitre.org/techniques/T1681"}]},{"type":"relationship","id":"relationship--004dea68-8e7a-5b5f-bf22-2910451c3fc2","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--279e95a1-6442-5d7b-89de-9ba0f3cedbfc"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--25d0491b-31c1-581f-829a-cafd24325352","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--f9db4e1e-9abd-5e51-b6ca-1e90729e6698","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Abuse Elevation Control Mechanism","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1548","url":"https://attack.mitre.org/techniques/T1548"}]},{"type":"relationship","id":"relationship--93729ca5-8120-5e06-8b35-13378488eca7","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--f9db4e1e-9abd-5e51-b6ca-1e90729e6698"},{"type":"attack-pattern","id":"attack-pattern--32e8531b-e8cb-5914-bbe9-17f4f87900c7","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Virtual Machine Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1673","url":"https://attack.mitre.org/techniques/T1673"}]},{"type":"relationship","id":"relationship--96f062e5-cfd4-5281-81dd-0b279fa8f2dd","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--32e8531b-e8cb-5914-bbe9-17f4f87900c7"},{"type":"attack-pattern","id":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Rootkit","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1014","url":"https://attack.mitre.org/techniques/T1014"}]},{"type":"relationship","id":"relationship--e318e2ae-346b-57e0-8b4b-10f07c547610","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--182a0a18-4d7a-5475-9065-8d903f2ec1f3"},{"type":"attack-pattern","id":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Network Sniffing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1040","url":"https://attack.mitre.org/techniques/T1040"}]},{"type":"relationship","id":"relationship--c5689424-fbe9-5107-b8b6-2f2ecbf1f8b6","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--258e3fb1-e445-5f1c-9500-46c1535597f6"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--e710a968-ea72-597b-a037-5ce8e7b8c92f","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--4b94705a-081b-5252-9105-217c16bdf469","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--44d7f217-6286-5cfa-8ddb-baac610b08b7","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"ESXi Administration Command","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1675","url":"https://attack.mitre.org/techniques/T1675"}]},{"type":"relationship","id":"relationship--45889287-49e6-5bbe-877a-6d0cde1add45","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--44d7f217-6286-5cfa-8ddb-baac610b08b7"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--40970ba2-cb02-5a73-ad8e-35eecfdd6613","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--d55fdb6a-9f9a-5d10-b91b-e3088a0ccefc","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Compromise Host Software Binary","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1554","url":"https://attack.mitre.org/techniques/T1554"}]},{"type":"relationship","id":"relationship--9002f140-c32c-57ee-a1a1-8bd13c16dc27","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--d55fdb6a-9f9a-5d10-b91b-e3088a0ccefc"},{"type":"attack-pattern","id":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Unix Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.004","url":"https://attack.mitre.org/techniques/T1059/004"}]},{"type":"relationship","id":"relationship--e90ff780-9e86-5863-827d-2e547f63fe76","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--3f182ee3-935a-5c66-b4c3-e706f91b8e82","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--647b5397-6f91-544b-9e1a-3a52d413955a","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--34c0f3cd-8875-58b0-b3c4-a42a159492b3","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Hypervisor CLI","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.012","url":"https://attack.mitre.org/techniques/T1059/012"}]},{"type":"relationship","id":"relationship--7cedd3bd-6c50-5df6-8365-bf572d1c4c3c","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--34c0f3cd-8875-58b0-b3c4-a42a159492b3"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--0a0641a3-dd85-50c9-a4d0-05c6229b6829","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--4d846c84-d216-512b-aa0f-77b39001adad","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--b49439f5-182d-5296-a0aa-d0dc186e366f","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Prevent Command History Logging","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1690","url":"https://attack.mitre.org/techniques/T1690"}]},{"type":"relationship","id":"relationship--62d50a66-5240-5a72-b220-ad8715011099","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--b49439f5-182d-5296-a0aa-d0dc186e366f"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--ddb04880-2964-5cb4-927e-f038bd787360","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--54569e33-9272-568a-b700-c93c2fb4e832","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--85eaaf23-7227-50b4-8917-2d32a78ea8ba","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--4e1ba08d-a4b4-5f2c-aa69-fc115dd2e77b","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--bebc15a2-cead-5eff-8154-5285b7185889","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--4dd10c02-6575-54d4-86e5-c61513d98cdd","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--4ae12a1b-1e1f-5513-a32c-be60a4aebb02","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--7ec24f15-d35d-53a6-b9fe-f86be9c208b4","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"RC Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037.004","url":"https://attack.mitre.org/techniques/T1037/004"}]},{"type":"relationship","id":"relationship--41e4754d-4dbf-50c7-9df4-e24bb17453f8","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--7ec24f15-d35d-53a6-b9fe-f86be9c208b4"},{"type":"attack-pattern","id":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Fallback Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1008","url":"https://attack.mitre.org/techniques/T1008"}]},{"type":"relationship","id":"relationship--2a0651d9-6e96-5d03-939e-872fee6a8efd","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c"},{"type":"attack-pattern","id":"attack-pattern--7f90384c-82a7-5515-863b-5e45c286816a","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Port Knocking","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1205.001","url":"https://attack.mitre.org/techniques/T1205/001"}]},{"type":"relationship","id":"relationship--1d608b62-9590-57e5-9fd6-14e99dc22908","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--7f90384c-82a7-5515-863b-5e45c286816a"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--b7bb50f2-2baa-5b12-8fc5-2909ee323571","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Disable or Modify System Firewall","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1686","url":"https://attack.mitre.org/techniques/T1686"}]},{"type":"relationship","id":"relationship--b661c714-b49f-5201-9434-2be8ed6a1017","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"uses","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee"},{"type":"location","id":"location--26bd43ce-64de-567e-a36d-0f23691c63dc","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Armenia","country":"AM","region":"asia"},{"type":"relationship","id":"relationship--d3d60c98-65f4-5a74-b149-bebcd5f6e6a7","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--26bd43ce-64de-567e-a36d-0f23691c63dc"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--b04e1eec-ffb9-5d4a-8590-1932e0edfb28","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--d795df54-4df5-5644-8ae9-cb4e638701e6","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--dbc3532e-62e8-517a-a716-da3a75d8f627","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--c884897c-acbb-5c7e-a467-c5fa6d98b353","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--4b8ab205-f9f1-5f21-a668-c9555d4f4285","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Ireland","country":"IE","region":"europe"},{"type":"relationship","id":"relationship--3a3bc334-acbb-5192-b36c-19a4be98a5b9","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--9dc6005f-ffaa-554b-9538-15ae378ae1e1","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--92b5ebe6-9601-5191-93ab-d8960eb05b36","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Liechtenstein","country":"LI","region":"europe"},{"type":"relationship","id":"relationship--c0a9212e-3291-5659-a01f-0b2ca443917d","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--92b5ebe6-9601-5191-93ab-d8960eb05b36"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--781e0631-d9ef-509b-b65a-8adf8bb7f9d4","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--8f69e99e-3d23-5fcd-9a95-666709193238","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--56bf51cb-502e-5b11-91f4-9e65333962a2","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--2f91d563-2046-59a3-a675-346fed625cb9","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--9c40438b-aff3-5a2b-bf27-daf1d1571350","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--0faabae5-5367-5313-9be5-68d7e2240bfa","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--976a6016-ca52-57a5-9aa1-5cfc3d03537b","spec_version":"2.1","created":"2026-05-20T09:51:08.830146+00:00","modified":"2026-05-20T09:51:08.830146+00:00","relationship_type":"targets","source_ref":"intrusion-set--45e052dd-24c6-5be2-b04b-3da233790ce8","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}