{"type":"bundle","id":"bundle--03e3b7e4-6a92-534a-8f2f-a7cd46758a9d","objects":[{"type":"intrusion-set","id":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Volt Typhoon","description":"PRC cluster targeting US critical infrastructure with living-off-the-land techniques.","aliases":["VOLTZITE","Dev-0391","INSIDIOUSTAUR","VANGUARD PANDA","UNC3236","G1017","BRONZE SILHOUETTE"],"first_seen":"2021-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/volt-typhoon"},{"source_name":"mitre-attack","external_id":"G1017","url":"https://attack.mitre.org/groups/G1017/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--e4973bd6-8f63-5c9d-a574-f022890c3954","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--b233ea64-d751-5c1f-8900-f7f40a47327d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--7b9f65a8-b0cf-5ff1-8458-113878494fe5","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1007","url":"https://attack.mitre.org/techniques/T1007"}]},{"type":"relationship","id":"relationship--02550ed9-03a9-5dba-89d5-eb12c4216eb1","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--fff0ed2f-4ab6-508c-a792-97e5b88a27c9"},{"type":"attack-pattern","id":"attack-pattern--d3a72a68-0e23-51d2-b55e-474dbe704534","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Application Window Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1010","url":"https://attack.mitre.org/techniques/T1010"}]},{"type":"relationship","id":"relationship--4e87f84b-25c8-5c76-93f1-05084f3eb853","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--d3a72a68-0e23-51d2-b55e-474dbe704534"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--ac4838fb-d50f-58b3-8d27-e44db594f0e7","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--f77fd900-23cb-5d8d-baf3-e908bf4578b9","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--3c8d8a19-c081-5281-8099-8c72f3cb1697","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--9a60ebd9-be97-5f15-8074-76b3df951a05","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--4a8f843b-74ff-5c04-8f20-56a6c173d626","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--cb710972-d4eb-57c4-b564-a51a3fc0c95b","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--b35d1fea-6757-5302-846a-3f3631fda131","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--4b033756-276a-5e1d-acf1-f44fb3874fc5","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Masquerade File Type","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.008","url":"https://attack.mitre.org/techniques/T1036/008"}]},{"type":"relationship","id":"relationship--50e66020-cb94-5e01-b9e7-f0bacb5d83ff","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--4b033756-276a-5e1d-acf1-f44fb3874fc5"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--a1cad7aa-2bc4-5001-a501-580432a649d5","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--07cf8ebb-b5f5-598d-8d6f-a567f5ea3dc8","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--420bf2fd-a0ab-50ff-a7ad-f186426b6e09","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--3975e828-3500-5bb0-969c-034ed166a4d2","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--50766a89-8821-5d57-8164-0588aa22784a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--e78625b9-d4e6-516f-bbef-191ced17ed69","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Unix Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.004","url":"https://attack.mitre.org/techniques/T1059/004"}]},{"type":"relationship","id":"relationship--08406314-208c-53ef-abb1-43d6191a1ecf","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a3389c80-16b9-56ce-a85e-0d17ac3c11e6"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--260e8be3-9e15-5394-a10c-882e742e1da0","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Local Groups","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069.001","url":"https://attack.mitre.org/techniques/T1069/001"}]},{"type":"relationship","id":"relationship--ec0f7c38-1209-5c0f-88d9-d09fe0e903cb","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--dc6a1040-ad7c-58b0-8d38-660140dac442","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--79d76dd8-a3b7-5f7a-8046-ecbe2d160324","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Data Staged","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1074","url":"https://attack.mitre.org/techniques/T1074"}]},{"type":"relationship","id":"relationship--a924a974-b537-5656-8717-4dd45c2b32ee","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--79d76dd8-a3b7-5f7a-8046-ecbe2d160324"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--bf42a77d-f1ef-5034-9d22-beb620666ee7","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--2f332d8f-546a-59b9-bb32-9fbbfbc31744","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--3c617670-3fb2-51f7-8da6-a3d2d286056f","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--3096aa06-06a7-553e-9588-9fa77b9dca2f","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--6fda10f8-3749-5df6-909d-bb427426785e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--2881fb0c-6e34-59ed-b6db-e911e5157f07","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--762d43dd-bf8b-5102-bd7b-e2115d5614e8","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--289d08e4-de66-5438-ab02-e9983c7a041e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--b2991200-1a6e-5e1f-9610-512313a229a0","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--712e2fe9-74cb-5a9c-a99a-ebb62a19806d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--15074baf-a51b-573c-8522-b66198a25751","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--adbb8b93-1086-5205-9782-d3bcf3ddd83a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--910b17b8-be8b-5629-8bbc-5fc248f63443","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--376255f7-e416-581c-9c36-feed19b5174a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Browser Information Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1217","url":"https://attack.mitre.org/techniques/T1217"}]},{"type":"relationship","id":"relationship--f040728f-f96d-57ca-a302-7aa579ffe12a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--376255f7-e416-581c-9c36-feed19b5174a"},{"type":"attack-pattern","id":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Binary Proxy Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218","url":"https://attack.mitre.org/techniques/T1218"}]},{"type":"relationship","id":"relationship--53ec3cd9-c992-532c-af38-4f419fd27f65","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--ed444845-3980-551d-b86f-45b5df87d9c3","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--a3863e32-455d-51c0-9ccb-e481d10d6a77","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Unsecured Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552","url":"https://attack.mitre.org/techniques/T1552"}]},{"type":"relationship","id":"relationship--1a24f516-578b-5ad0-a04c-41874a1098a8","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a3863e32-455d-51c0-9ccb-e481d10d6a77"},{"type":"attack-pattern","id":"attack-pattern--2db6b72c-e76c-5fc8-ac3b-a1be30adca80","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Private Keys","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.004","url":"https://attack.mitre.org/techniques/T1552/004"}]},{"type":"relationship","id":"relationship--3893177d-c008-5a5e-9dcf-0fe0336eb12b","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--2db6b72c-e76c-5fc8-ac3b-a1be30adca80"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--56032790-dff5-5477-836c-9d03265a447e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--6bd65716-de33-5e29-8765-a751add48d89","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--cc63fb88-0355-53cc-bf5d-22625bb84511","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--c48fe563-c08f-501e-812a-f92bf21b49e1","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--0f1e2bb3-5fa4-5b31-bacd-9b7b6eaf29ae","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Gather Victim Network Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1590","url":"https://attack.mitre.org/techniques/T1590"}]},{"type":"relationship","id":"relationship--18684b8b-b4d4-5be5-94bd-dc8af8781645","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--829d63b7-cceb-5bcf-a372-dd4649d16541"},{"type":"attack-pattern","id":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Gather Victim Org Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591","url":"https://attack.mitre.org/techniques/T1591"}]},{"type":"relationship","id":"relationship--1431425a-6a2d-59bf-a1ad-b9b3b9e9d945","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15"},{"type":"attack-pattern","id":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Identify Roles","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591.004","url":"https://attack.mitre.org/techniques/T1591/004"}]},{"type":"relationship","id":"relationship--bcac7621-12f2-552e-ab60-796f3fc51e96","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e"},{"type":"attack-pattern","id":"attack-pattern--de9bd308-2570-5d1d-8a8c-02c2e60b5b2d","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Gather Victim Host Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1592","url":"https://attack.mitre.org/techniques/T1592"}]},{"type":"relationship","id":"relationship--38cf177d-0e11-5e6e-8ca6-0a2a6677a81f","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--de9bd308-2570-5d1d-8a8c-02c2e60b5b2d"},{"type":"attack-pattern","id":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Search Open Websites/Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1593","url":"https://attack.mitre.org/techniques/T1593"}]},{"type":"relationship","id":"relationship--ae6d0e9a-7841-59d4-9afc-55f3489ca9ad","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e"},{"type":"attack-pattern","id":"attack-pattern--d403a61c-7938-5d1b-ac03-e6cefd030168","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Search Victim-Owned Websites","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1594","url":"https://attack.mitre.org/techniques/T1594"}]},{"type":"relationship","id":"relationship--e08a82b3-c38d-5b72-a938-074113a700c6","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--d403a61c-7938-5d1b-ac03-e6cefd030168"},{"type":"attack-pattern","id":"attack-pattern--fc5dcd5a-dc9e-574d-8be2-53573b556856","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Scan Databases","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1596.005","url":"https://attack.mitre.org/techniques/T1596/005"}]},{"type":"relationship","id":"relationship--e2bbeafd-e0d4-541f-badf-9bfe06ea5270","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--fc5dcd5a-dc9e-574d-8be2-53573b556856"},{"type":"attack-pattern","id":"attack-pattern--7b249cb9-2608-5d8f-ba60-60a50bbf7e4a","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"System Location Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1614","url":"https://attack.mitre.org/techniques/T1614"}]},{"type":"relationship","id":"relationship--9637219b-d93b-5310-9206-65a03742fbed","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--7b249cb9-2608-5d8f-ba60-60a50bbf7e4a"},{"type":"attack-pattern","id":"attack-pattern--13f3ccee-8f92-557e-9ba8-850945b7b4f3","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Log Enumeration","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1654","url":"https://attack.mitre.org/techniques/T1654"}]},{"type":"relationship","id":"relationship--f4448d8c-01ee-5427-9f74-eb5cee7c3d55","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--13f3ccee-8f92-557e-9ba8-850945b7b4f3"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--816a9e2a-c9bc-58b7-8620-b867ca1cb70f","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"uses","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--21296735-070e-5a30-8895-04c6cb1bb688","spec_version":"2.1","created":"2026-05-20T09:52:30.14616+00:00","modified":"2026-07-29T07:07:30.706+00:00","relationship_type":"targets","source_ref":"intrusion-set--cff77e9c-5f35-5613-8ee4-6027737e74c9","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}