{"type":"bundle","id":"bundle--a436653a-e6f3-57de-9b0c-ac1203508e82","objects":[{"type":"intrusion-set","id":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Void Manticore","aliases":["Void Manticore","Storm-0842","Karma","Plaid Rain"],"first_seen":"2023-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/void-manticore"}],"labels":["nation-state","dis"]},{"type":"attack-pattern","id":"attack-pattern--84215ab3-592c-536d-9209-1bd82730aecd","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Selective Exclusion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1679","url":"https://attack.mitre.org/techniques/T1679"}]},{"type":"relationship","id":"relationship--47d86daf-8777-5b82-81b8-ffe8afd31b9c","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--84215ab3-592c-536d-9209-1bd82730aecd"},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--344dbc72-ab2f-510e-b4aa-1b30c3dd5666","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--184e8c48-44dc-5b8b-99b4-445a6e123dcd","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--6f6f51d7-2788-5358-b55e-bcc53ad3ef78","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--08579a85-0772-533c-9876-123ea9547229","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Software Deployment Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1072","url":"https://attack.mitre.org/techniques/T1072"}]},{"type":"relationship","id":"relationship--3fff5006-8945-5ed2-aabe-8dfcb4470c7e","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16"},{"type":"attack-pattern","id":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Account Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098","url":"https://attack.mitre.org/techniques/T1098"}]},{"type":"relationship","id":"relationship--12bdd325-db32-51ea-aded-d87f306a67c3","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--fcbde0c1-7377-542b-a7c6-b0a2b7f25ea9","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--0221b8ee-510a-5dc9-92da-b3d2c62dd73d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--03fc00df-d0c3-5c8d-90ef-f0edf6acc7c0","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Audio Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1123","url":"https://attack.mitre.org/techniques/T1123"}]},{"type":"relationship","id":"relationship--e38b9d01-0f94-5118-89e5-63fd5e4fc09d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--03fc00df-d0c3-5c8d-90ef-f0edf6acc7c0"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--6a8ea7ba-7b21-51ad-8590-69c7940298e1","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--382a9719-c4fb-5a29-be21-9fdf9590b3ea","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.004","url":"https://attack.mitre.org/techniques/T1583/004"}]},{"type":"relationship","id":"relationship--2a4923e8-419b-55f3-9ade-ca593374c864","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648"},{"type":"attack-pattern","id":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Disk Structure Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.002","url":"https://attack.mitre.org/techniques/T1561/002"}]},{"type":"relationship","id":"relationship--18fb974b-e7cb-5bd9-8604-6016b36e64ee","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--5f3c5199-e0d2-563b-8f19-7acd5b01a6e7","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--3cbd6ef5-4c9e-5534-83c2-2d75be3f1d71","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Credentials in Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.002","url":"https://attack.mitre.org/techniques/T1552/002"}]},{"type":"relationship","id":"relationship--0619fdfa-1ade-5c01-97f0-5fe2bf725725","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--3cbd6ef5-4c9e-5534-83c2-2d75be3f1d71"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--815ca4c6-24d6-5031-9658-77d68f552d5f","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--12545bd0-56c6-5ee2-b4cb-31bd669b5fa7","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--319ae6fa-5af4-59f5-ba87-b8610822ef7e","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Video Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1125","url":"https://attack.mitre.org/techniques/T1125"}]},{"type":"relationship","id":"relationship--d43b601e-7995-57a3-b33d-04ecde263daa","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--319ae6fa-5af4-59f5-ba87-b8610822ef7e"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--c7ec7b9c-54e5-57fe-b3de-bd194d73cdb0","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--9d0250e7-afe5-5eeb-b494-61d4b52f6d6a","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--d6c77e40-0c42-5b2d-863c-bd7ebc8f5b15","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--4ed2508b-1a77-55b9-9992-6bbf3d02238b","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--2c4f6ae4-3e25-5666-9852-894a6d569a2d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--3f168ac2-29ff-5668-b153-0c39dde72d8f","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--4845f276-53ff-52fc-a4ab-fd56a91af163","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--85f6a2ac-674d-5d46-88a7-5c18ba3e06f9","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--7002b29c-c160-5bfa-8087-051ea8737040","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--949bad67-e109-54a5-b153-6258e25407e4","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--c7fcdc5d-828f-5ccb-9d51-d562a4d9e508","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--a1d1dbab-a7b0-558d-9f41-b9f561a6f011","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"attack-pattern","id":"attack-pattern--976f5a63-9082-5922-b0f1-ebb005c96bcb","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Cloud Administration Command","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1651","url":"https://attack.mitre.org/techniques/T1651"}]},{"type":"relationship","id":"relationship--540fecb1-5b26-5c2e-bde1-a313f01991e8","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--976f5a63-9082-5922-b0f1-ebb005c96bcb"},{"type":"attack-pattern","id":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Disk Content Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.001","url":"https://attack.mitre.org/techniques/T1561/001"}]},{"type":"relationship","id":"relationship--288329a7-4fac-52c8-a478-cf5b8ba2a255","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270"},{"type":"attack-pattern","id":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Remote Desktop Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219.002","url":"https://attack.mitre.org/techniques/T1219/002"}]},{"type":"relationship","id":"relationship--9b2e991a-a883-536f-82be-c5a2b5fdda41","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911"},{"type":"attack-pattern","id":"attack-pattern--79d76dd8-a3b7-5f7a-8046-ecbe2d160324","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Data Staged","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1074","url":"https://attack.mitre.org/techniques/T1074"}]},{"type":"relationship","id":"relationship--e15f3c49-793f-53da-a280-60d3066d0576","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--79d76dd8-a3b7-5f7a-8046-ecbe2d160324"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--ad82d838-5f9b-58ea-8763-4f3254615d41","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--5644c94c-167f-549b-b83b-181b7415b097","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Credential Stuffing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110.004","url":"https://attack.mitre.org/techniques/T1110/004"}]},{"type":"relationship","id":"relationship--72903f36-4bd3-5983-81ae-09fc4ce66bd8","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--5644c94c-167f-549b-b83b-181b7415b097"},{"type":"attack-pattern","id":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Cloud Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.004","url":"https://attack.mitre.org/techniques/T1078/004"}]},{"type":"relationship","id":"relationship--70296661-05bf-5fdd-8ef2-bd65a01671c4","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--4c1f111d-057c-519f-844d-5b4247159560","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--b3a02d44-c92d-5cd8-87c5-a17d35fec384","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--0d885032-ab48-5138-bde6-1829e481f8cb","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Financial Theft","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1657","url":"https://attack.mitre.org/techniques/T1657"}]},{"type":"relationship","id":"relationship--52c9ea8f-2261-5aff-b10d-3e7b5d85f7e5","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12"},{"type":"attack-pattern","id":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Data Destruction","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1485","url":"https://attack.mitre.org/techniques/T1485"}]},{"type":"relationship","id":"relationship--aecf9458-a194-595c-a671-faf860e94029","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--b273306a-9c7d-515b-88dc-785782c882c5","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Inhibit System Recovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1490","url":"https://attack.mitre.org/techniques/T1490"}]},{"type":"relationship","id":"relationship--bd78774e-f270-5b6b-a74f-e9b4209229f0","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117"},{"type":"attack-pattern","id":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Compression","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.015","url":"https://attack.mitre.org/techniques/T1027/015"}]},{"type":"relationship","id":"relationship--200eafea-e2b1-5b17-84d4-76881aef57d9","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"uses","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944"},{"type":"location","id":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Albania","country":"AL","region":"europe"},{"type":"relationship","id":"relationship--0c08d9cb-3c4d-59ab-a84e-cebbcaa9a451","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"targets","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"location--04cd9956-7847-535f-b3f8-2c15fc015ff1"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--30512728-ac5a-5bbc-8327-fccb716ad8a6","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"targets","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--671536e6-945a-50d2-812e-660a03c3dd58","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"Lebanon","country":"LB","region":"asia"},{"type":"relationship","id":"relationship--64f1ce9c-893c-5323-8924-c24d8491d969","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"targets","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"location--671536e6-945a-50d2-812e-660a03c3dd58"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--4e15db94-ba1d-5a1d-8d7a-5fce698fea94","spec_version":"2.1","created":"2026-05-20T09:52:29.86433+00:00","modified":"2026-05-20T09:52:29.86433+00:00","relationship_type":"targets","source_ref":"intrusion-set--d29fca89-6dd3-5e50-981c-b1056928de9d","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}