{ "type": "bundle", "id": "bundle--9e5eecba-aa7e-474a-80a6-1866b1261370", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.850925Z", "modified": "2026-08-04T01:37:25.850925Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--48779663-8996-5cdf-8eb8-4c4db90c6ee4", "value": "91.197.98.188" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8283b415-7124-5749-baaf-6fdc09a16ecf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.854464Z", "modified": "2026-08-04T01:37:25.854464Z", "name": "ipv4: 91.197.98.188", "description": "[operator_estate] Also serves CloudSync C2 on :5555 (bk dropped implant) and :7777 (svhost4), both cleartext TCP, wait-then-speak, no banner", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.197.98.188']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--07ad3d66-c1ab-56c3-a7f8-30f76dcd7a08", "value": "91.92.43.221" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--27ebf16a-7afb-514f-8c0c-460fa72a4dc6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.863509Z", "modified": "2026-08-04T01:37:25.863509Z", "name": "ipv4: 91.92.43.221", "description": "[operator_estate] Ports 5000-5003 serve identical CloudSync-Dashboard panel; client->5000, s->5001, q->5002; 5003 live with no build in hand. Aeza OFAC-designated 2025; DEDIK-inside-designation unproven.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.92.43.221']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--7fcd6ffa-2566-53e1-a0d4-84bee033eb55", "value": "2.27.248.138" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cc0fd9f4-b13c-5253-bd85-adb3d6784e68", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.864617Z", "modified": "2026-08-04T01:37:25.864617Z", "name": "ipv4: 2.27.248.138", "description": "[operator_estate] Raw-IP TCP, no domain. :8443 = Express/socket.io operator panel (cert CN=localhost); :1337 = operator RDP (cert CN=DESKTOP-KHCG4S8)", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '2.27.248.138']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--f91c189c-6503-56e3-a576-c6955156fea7", "value": "http://91.197.98.188:8000/client.exe" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--20a11a24-904c-52a1-af61-880d4ba64c2a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.865657Z", "modified": "2026-08-04T01:37:25.865657Z", "name": "url: http://91.197.98.188:8000/client.exe", "description": "[operator_estate] Fetched with a spoofed browser User-Agent and proxy-credential inheritance", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://91.197.98.188:8000/client.exe']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--749b8ec1-53aa-5aa1-9c62-8ed803a11609", "value": "api.telegram.org" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a6801bf7-4893-5b1a-b89a-d7b5fadf91f4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.86849Z", "modified": "2026-08-04T01:37:25.86849Z", "name": "domain: api.telegram.org", "description": "[operator_estate] Legitimate Telegram API domain used by many benign apps. Only suspicious paired with a workstation running Tor / the CloudSync working directory. Do not block outright.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'api.telegram.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--700dfafc-eee9-59ac-b3d4-a0b357924bf9", "value": "c3lestial.fun" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--21158ea7-c877-53d7-ad58-e7c05f9ceb0b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.8701Z", "modified": "2026-08-04T01:37:25.8701Z", "name": "domain: c3lestial.fun", "description": "[sourced_commodity_stealer_indicators] NOT operator-owned. Shared Hostinger hosting. Detect via TLS SNI; do NOT author a POST/method-bound rule on /receive.php - it would not fire on real traffic.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'c3lestial.fun']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--37b1aad0-b5ba-50cf-880d-f3f12740c2c5", "value": "ip-api.com" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--893e239a-a5dd-56bc-a561-9c79952cc75b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.870863Z", "modified": "2026-08-04T01:37:25.870863Z", "name": "domain: ip-api.com", "description": "[sourced_commodity_stealer_indicators] Legitimate geolocation service, heavily used by benign software. Only a co-signal when paired with an unrelated TLS SNI within seconds.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ip-api.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-08-03T00:00:00Z", "confidence": 40, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 40 }, { "type": "file", "spec_version": "2.1", "id": "file--ea450fc8-05e9-5229-8573-7325634cb7b6", "hashes": { "SHA-256": "62aa8e470e60aa9fa77df6e6e63b7c253657e95d6018240b1752a9ca9fe389fa" } }, { "type": "file", "spec_version": "2.1", "id": "file--a94df1be-e328-5b80-92b4-da5032956fab", "hashes": { "SHA-256": "0ba14e1443c155a0e644b0d83d5f89c2c188556367d15ccd86f0b6787cfac4d7" } }, { "type": "file", "spec_version": "2.1", "id": "file--48a93381-e5ee-563b-b1b9-ae1de6414b1a", "hashes": { "SHA-256": "fe9e54800c54efb46301f4cff3c3870be6b617ebdbe2b786220dbd8b337a33b0" } }, { "type": "file", "spec_version": "2.1", "id": "file--39a3e0ec-082a-57f6-b9ff-c5c42ce1bebf", "hashes": { "SHA-256": "6bd0366372b7d765e76c5a888d68a4991ad04ee614bdb589a20ffbe433db58fc" } }, { "type": "file", "spec_version": "2.1", "id": "file--6d11529c-18b2-5abd-89a0-87e675829da0", "hashes": { "SHA-256": "9744c12a06b4562e175d4aeb7b8fd5c1e1877ac30222af8243eeaae16df324b0" } }, { "type": "file", "spec_version": "2.1", "id": "file--29525a57-f106-5828-af80-74dcf9ecc197", "hashes": { "SHA-256": "d25a3a858e28faa68ca6c624d7d19350c11ac798c346be3067307463e40aaff1" } }, { "type": "file", "spec_version": "2.1", "id": "file--d7ad5f7c-4e60-5219-8882-85e01dd0a458", "hashes": { "SHA-256": "0ff0cee1fbf1050fbe3ab91918e56334a93269265e5614717ec0441baa8c42df" } }, { "type": "file", "spec_version": "2.1", "id": "file--e439fc4f-77ad-5730-bd71-fd0605568b4d", "hashes": { "SHA-256": "4b115a9f745219e3f3abdea275da89f35e4ec5f3d43286e5efc58eaf8049f3f7" } }, { "type": "file", "spec_version": "2.1", "id": "file--648a840a-99ba-5007-8583-9f676e1363d3", "hashes": { "SHA-256": "b4cc5ac328afd0e7eaf16216879046367e083279bfdb831da3a53c8a31df3d1b" } }, { "type": "file", "spec_version": "2.1", "id": "file--49ae7f1c-0661-5bdd-94b2-853ad198cc84", "hashes": { "SHA-256": "7a5c5d1e41d5e2c8c0f09d5dccb78932de535963d21350b2581716c8a753fd66" } }, { "type": "file", "spec_version": "2.1", "id": "file--e674a89f-87a6-51dc-a3aa-82d2c174d389", "hashes": { "SHA-256": "e924acdb4aea72bdf1db5ab121a2bcbfddd33fd2d3d8c8907441ce3a6dfef10b" } }, { "type": "file", "spec_version": "2.1", "id": "file--6cd6b88f-9bf1-50f7-992f-9cb813f57718", "hashes": { "SHA-256": "79b6f2eb6583a83aabe590264de08c0ad1eb7e960ae9a4bdbc6ed84142ce95a9" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--78b34948-9a84-548e-b370-cd602bfd3367", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.874497Z", "modified": "2026-08-04T01:37:25.874497Z", "name": "RAT_CloudSync_TorPanel_NetscanBuild", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Yara Rule Set\n Identifier: CloudSync Assembler Toolkit - 91.197.98.188\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule RAT_CloudSync_TorPanel_NetscanBuild {\n meta:\n description = \"Detects the later-build CloudSync Tor-panel RAT (client.exe/q.exe/s.exe) via embedded HTML/JS markup for its CIDR+port network scanner panel tab, unique to the later of two known CloudSync build generations\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"62aa8e470e60aa9fa77df6e6e63b7c253657e95d6018240b1752a9ca9fe389fa\"\n family = \"CloudSync\"\n malware_type = \"RAT\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"b14306ec-cdfb-5107-bf6f-156ea821ae75\"\n strings:\n $api1 = \"/api/netscan\" ascii\n $html1 = \"id='scan-cidr'\" ascii\n $html2 = \"placeholder='Target CIDR (e.g. 192.168.1.0/24)'\" ascii\n $html3 = \"id='netscan-output'\" ascii\n $html4 = \"showTab('netscan'\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 60MB and\n 3 of them\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3832238b-e9ff-5b1b-9c62-6315c3bd64e2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.87489Z", "modified": "2026-08-04T01:37:25.87489Z", "name": "RAT_CloudSync_C2Protocol_DualBuild", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_CloudSync_C2Protocol_DualBuild {\n meta:\n description = \"Detects CloudSync's cleartext TCP C2 registration/heartbeat protocol strings across both observed build generations, which differ in message terminator ([C2_END] vs [END]) and registration field names\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"9744c12a06b4562e175d4aeb7b8fd5c1e1877ac30222af8243eeaae16df324b0\"\n family = \"CloudSync\"\n malware_type = \"RAT\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"df292c17-07ad-5292-9f33-206ab7582bdd\"\n strings:\n $autoupd = \"=== AUTO UPDATE ===\" ascii\n $heartbeat = \"[Shares]\" ascii\n $term1 = \"[C2_END]\" ascii\n $term2 = \"[END]\" ascii\n $field1 = \"AnyDesk Pass:\" ascii\n $field2 = \"AD Pwd:\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 60MB and\n 2 of them\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f482c958-8d70-57c2-9dad-cd0c7c24061b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.875191Z", "modified": "2026-08-04T01:37:25.875191Z", "name": "RAT_SvchostPayload_ParalellInjector_TypeNames", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_SvchostPayload_ParalellInjector_TypeNames {\n meta:\n description = \"Detects the sourced Paralell (Blind Eagle-associated) reflective injector and the custom SvchostPayload .NET RAT via debug PDB path fragment and distinctive obfuscated/cleartext type and member names; matches the on-disk cls.exe sibling build and, when captured, in-memory dumps of Crystal-Monk.dll and SvchostPayload\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"79b6f2eb6583a83aabe590264de08c0ad1eb7e960ae9a4bdbc6ed84142ce95a9\"\n hash3 = \"135877ecc663ee47340a4726078234f0\"\n family = \"SvchostPayload\"\n malware_type = \"RAT\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"5d097282-dcf6-58bf-a8e8-17d97cff3ec2\"\n strings:\n $pdb = \"Paralell\\\\Paralell\\\\bin\\\\x64\\\\Debug\\\\CryptoObfuscator_Output\\\\Crystal-Monk.pdb\" ascii\n $t1 = \"SvchostPayload\" ascii wide fullword\n $t2 = \"BrowserCredentialRecovery\" ascii fullword\n $t3 = \"Crystal-Monk\" ascii wide\n $t4 = \"VoidNexus\" ascii fullword\n $t5 = \"ShadowWeave\" ascii fullword\n $t6 = \"CrystalCore\" ascii fullword\n $t7 = \"UmbraGate\" ascii fullword\n condition:\n uint16(0) == 0x5A4D and\n filesize < 5MB and\n ($pdb or 2 of ($t*))\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--905535be-fa82-5642-80b4-d05d43708b7e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.875347Z", "modified": "2026-08-04T01:37:25.875347Z", "name": "Loader_SvchostJS_CustomAlphabet", "indicator_types": [ "malicious-activity" ], "pattern": "rule Loader_SvchostJS_CustomAlphabet {\n meta:\n description = \"Detects the svhost.js WSH JScript fileless loader via its custom 16-character substitution alphabet used in a layered base16-XOR plus AES/ChaCha/permutation decoder, and the loader's distinctive function-constructor string-decode shape\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"4b115a9f745219e3f3abdea275da89f35e4ec5f3d43286e5efc58eaf8049f3f7\"\n family = \"SvchostPayload\"\n malware_type = \"Loader\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"2b39854f-a2dc-535f-824f-b28af4328b35\"\n strings:\n $alpha = \"5v_qoKAku06M^ZW1\" ascii\n $shape1 = \"(function(){})[\\\"constructor\\\"]\" ascii\n $shape2 = \"String.fromCharCode\" ascii\n condition:\n filesize < 1MB and\n ($alpha or all of ($shape*))\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57ed259c-002b-5786-96ce-12fd1fb8d493", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.875522Z", "modified": "2026-08-04T01:37:25.875522Z", "name": "Loader_ABExe_DeploymentOrchestrator_Banners", "indicator_types": [ "malicious-activity" ], "pattern": "rule Loader_ABExe_DeploymentOrchestrator_Banners {\n meta:\n description = \"Detects the ab.exe post-compromise deployment orchestrator via its fixed-sequence console banner strings and the German-localized Active Directory privileged-group names it targets when creating a hidden backdoor account\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"d25a3a858e28faa68ca6c624d7d19350c11ac798c346be3067307463e40aaff1\"\n family = \"CloudSync\"\n malware_type = \"Orchestrator\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"bcfebc4f-1273-566e-8121-19cd9dc91272\"\n strings:\n $b1 = \"Starting deployment - WebShell First\" ascii wide\n $b2 = \"=== WEB SHELL ===\" ascii wide\n $b3 = \"=== USER ===\" ascii wide\n $b4 = \"=== ANYDESK ===\" ascii wide\n $b5 = \"All tasks completed successfully!\" ascii wide\n $grp1 = \"Organisations-Admins\" ascii wide\n $grp2 = \"Schema-Admins\" ascii wide\n $grp3 = \"Administratoren\" ascii wide fullword\n $adu = \"New-ADUser\" ascii wide\n $guest = \"Guest$\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 2MB and\n 3 of them\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d5b2dde-07e9-5752-89df-4d26f63d2131", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.875723Z", "modified": "2026-08-04T01:37:25.875723Z", "name": "Loader_CtBat_ProxyAwareUSBWormStub", "indicator_types": [ "malicious-activity" ], "pattern": "rule Loader_CtBat_ProxyAwareUSBWormStub {\n meta:\n description = \"Detects the ct.bat infection stub via a combination of its distinctive command fragments: proxy-credential-inheriting WebClient download, USB drive enumeration for its worm loop, autorun.inf propagation, and its AMSI-bypass field name\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"0ff0cee1fbf1050fbe3ab91918e56334a93269265e5614717ec0441baa8c42df\"\n family = \"CloudSync\"\n malware_type = \"Loader\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"21d45221-9c71-50e5-89fa-a7b3d0ea4e76\"\n strings:\n $proxy = \"DefaultCredentials\" ascii\n $wmic = \"wmic logicaldisk where\" ascii\n $autorun = \"autorun.inf\" ascii\n $amsi = \"amsiInitFailed\" ascii\n $sysupd = \"SystemUpdate\" ascii\n condition:\n filesize < 5KB and\n 2 of them\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1432aab7-b938-55b1-82d9-f5f25a0114ca", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.875933Z", "modified": "2026-08-04T01:37:25.875933Z", "name": "RAT_CloudSync_PublicWorkdir_Artifacts", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_CloudSync_PublicWorkdir_Artifacts {\n meta:\n description = \"Detects CloudSync working-directory, dropped-Tor-binary, and mutex string artifacts common to droppers and implants across both build generations; broader and lower-precision than the dedicated panel and protocol rules, intended for hunting\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188/\"\n date = \"2026-08-03\"\n hash1 = \"6bd0366372b7d765e76c5a888d68a4991ad04ee614bdb589a20ffbe433db58fc\"\n family = \"CloudSync\"\n malware_type = \"RAT\"\n campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n id = \"d226bb58-e0bc-5f2e-8846-d8b3cb415bc2\"\n strings:\n $wd1 = \"C:\\\\Users\\\\Public\\\\fs\\\\\" ascii\n $wd2 = \"C:\\\\Users\\\\Public\\\\filesystem\" ascii\n $hs = \"hidden_service\" ascii\n $thw = \"taskhostw.exe\" ascii\n $frf = \"first_run.flag\" ascii\n $mtx1 = \"Global\\\\WUDFHost\" ascii wide\n $mtx2 = \"Global\\\\WinUpdateSvcMutex\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 60MB and\n 3 of them\n}", "pattern_type": "yara", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a235c665-2aab-5d95-a724-38e6eca63144", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.876212Z", "modified": "2026-08-04T01:37:25.876212Z", "name": "CloudSync RAT Guest Dollar Local Account Persistence Command", "indicator_types": [ "malicious-activity" ], "pattern": "title: CloudSync RAT Guest Dollar Local Account Persistence Command\nid: 301385e1-0331-459e-b547-6229cf0788ff\nstatus: experimental\ndescription: >-\n Detects a \"net user\" command targeting a local account named \"Guest$\" without\n the \"/domain\" switch. CloudSync's implant re-issues this command on a short cycle\n to keep a local machine-account-masquerade backdoor present; the trailing dollar\n sign mimics a computer-account naming convention that most admins never use for a\n local user.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.t1136.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'net user'\n - 'Guest$'\n filter_domain:\n CommandLine|contains: '/domain'\n condition: selection and not filter_domain\nfalsepositives:\n - Unlikely, local accounts ending in a literal dollar sign are not a standard Windows naming convention\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59ba7a73-34c5-5942-a725-fa753d9071b4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.87644Z", "modified": "2026-08-04T01:37:25.87644Z", "name": "CloudSync RAT Windows Update Service Masquerade Installation", "indicator_types": [ "malicious-activity" ], "pattern": "title: CloudSync RAT Windows Update Service Masquerade Installation\nid: 0ae91cbf-e335-4060-9283-8862790a7c0e\nstatus: experimental\ndescription: >-\n Detects installation of a Windows service whose display name is \"Windows Update\n Service\". The genuine Windows Update service display name is \"Windows Update\"\n (short form), the extra word is CloudSync's masquerade convention for its\n svhost4 implant's persistence service, and does not occur in stock Windows.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1543.003\nlogsource:\n product: windows\n service: system\ndetection:\n selection:\n Provider_Name: 'Service Control Manager'\n EventID: 7045\n ServiceName: 'Windows Update Service'\n condition: selection\nfalsepositives:\n - Unlikely, the genuine Windows Update service display name is \"Windows Update\", not \"Windows Update Service\"\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fb98c2b6-0f68-55d1-990e-1e4241aafd43", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.87667Z", "modified": "2026-08-04T01:37:25.87667Z", "name": "CloudSync RAT Tor Hidden Service Staging Under Public Profile", "indicator_types": [ "malicious-activity" ], "pattern": "title: CloudSync RAT Tor Hidden Service Staging Under Public Profile\nid: 4a7f8a52-bc79-48d2-8776-550cad2455af\nstatus: experimental\ndescription: >-\n Detects file creation consistent with CloudSync standing up a per-victim Tor\n hidden service from a working directory under the shared Public profile, a\n masqueraded Tor binary named taskhostw.exe, or any file written inside a\n hidden_service subdirectory of C:\\Users\\Public\\. The build-variant working\n directory name (fs vs filesystem) is not required; the anchor is the Public-path\n root paired with the Tor hidden-service artifact.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.command-and-control\n - attack.t1090.003\n - attack.stealth\n - attack.t1036.005\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection_taskhostw:\n TargetFilename|contains: '\\Users\\Public\\'\n TargetFilename|endswith: '\\taskhostw.exe'\n selection_hiddensvc:\n TargetFilename|contains|all:\n - '\\Users\\Public\\'\n - '\\hidden_service\\'\n condition: 1 of selection_*\nfalsepositives:\n - Unlikely, legitimate software does not write an executable named taskhostw.exe or create a hidden_service directory under the shared Public profile\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--03ca9929-1c95-56df-88c4-5b035e89bdfd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.876924Z", "modified": "2026-08-04T01:37:25.876924Z", "name": "Wscript To PowerShell To MSBuild Execution Chain Without Project File", "indicator_types": [ "malicious-activity" ], "pattern": "title: Wscript To PowerShell To MSBuild Execution Chain Without Project File\nid: 4f593a7e-a980-452a-bc36-25db2acf2c7c\nstatus: experimental\ndescription: >-\n Detects MSBuild.exe launched directly by a hidden, execution-policy-bypassed\n PowerShell process with no build-project argument (no .csproj/.vbproj/.sln/.xml/\n .proj/.targets path on the command line). Legitimate MSBuild invocations, even\n from a shell, almost always pass a project or target path; a bare invocation is\n consistent with using MSBuild as a hollow injection target rather than as a\n build tool. Observed as the final stage of a wscript-launched fileless loader\n chain that injects a custom .NET RAT into the resulting process.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.stealth\n - attack.privilege-escalation\n - attack.execution\n - attack.t1127.001\n - attack.t1055\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\MSBuild.exe'\n - OriginalFileName: 'MSBuild.exe'\n selection_parent:\n ParentImage|endswith: '\\powershell.exe'\n ParentCommandLine|contains:\n - '-w hidden'\n - '-windowstyle hidden'\n - '-ep bypass'\n - '-ExecutionPolicy Bypass'\n filter_project_file:\n CommandLine|contains:\n - '.csproj'\n - '.vbproj'\n - '.sln'\n - '.proj'\n - '.targets'\n - '.xml'\n condition: all of selection_* and not filter_project_file\nfalsepositives:\n - Developer or CI tooling that launches MSBuild from a hidden PowerShell wrapper without a visible project path on the command line\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e68dec58-880d-5780-8266-e9143fb2e90a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.877179Z", "modified": "2026-08-04T01:37:25.877179Z", "name": "MSBuild Process Making a Direct Outbound Network Connection", "indicator_types": [ "malicious-activity" ], "pattern": "title: MSBuild Process Making a Direct Outbound Network Connection\nid: 9629ebb5-35e9-4e2c-b209-c66eee51f0ea\nstatus: experimental\ndescription: >-\n Detects MSBuild.exe itself initiating an outbound TCP connection. MSBuild does\n not make direct network connections as part of normal build activity (NuGet\n restore and package operations run through separate client processes); an\n outbound connection from MSBuild.exe is consistent with a RAT running inside an\n injected MSBuild process beaconing to its command-and-control server.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.stealth\n - attack.execution\n - attack.t1127.001\nlogsource:\n category: network_connection\n product: windows\ndetection:\n selection:\n Image|endswith: '\\MSBuild.exe'\n Initiated: 'true'\n condition: selection\nfalsepositives:\n - Unknown, MSBuild network activity is rare in normal build environments but has not been exhaustively surveyed across all CI configurations\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--edd8bea6-b5de-5b46-acdd-0d6168e94e1f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.877398Z", "modified": "2026-08-04T01:37:25.877398Z", "name": "Windows Defender Tampering Via Set-MpPreference Disable Switches", "indicator_types": [ "malicious-activity" ], "pattern": "title: Windows Defender Tampering Via Set-MpPreference Disable Switches\nid: 3b3283c2-d047-402f-b46d-b6fb43faebf3\nstatus: experimental\ndescription: >-\n Detects a PowerShell Set-MpPreference or Add-MpPreference command disabling\n Windows Defender real-time protection, IOAV protection, or behavior monitoring.\n Observed issued from inside an injected MSBuild.exe process immediately after a\n fileless .NET RAT loads, to blind Defender ahead of further activity.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.defense-impairment\n - attack.t1685\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_cmdlet:\n CommandLine|contains:\n - 'Set-MpPreference'\n - 'Add-MpPreference'\n selection_option:\n CommandLine|contains:\n - 'DisableRealtimeMonitoring'\n - 'DisableIOAVProtection'\n - 'DisableBehaviorMonitoring'\n condition: selection_cmdlet and selection_option\nfalsepositives:\n - Administrative hardening or troubleshooting scripts that legitimately toggle Defender preferences\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--47fcbba0-311e-567f-8c06-bf382699acc6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.877613Z", "modified": "2026-08-04T01:37:25.877613Z", "name": "Photo Studio Masquerade Loader Files Under LocalAppData", "indicator_types": [ "malicious-activity" ], "pattern": "title: Photo Studio Masquerade Loader Files Under LocalAppData\nid: d570d892-64b5-4eb9-ad99-2b615230bbdf\nstatus: experimental\ndescription: >-\n Detects creation of a JScript or VBScript file inside a \"Photo Studio\" directory\n under the user's LocalAppData folder. This is the on-disk persistence copy and\n windowless relaunch wrapper for a fileless .NET RAT loader; no legitimate \"Photo\n Studio\" application is installed by this path convention.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.stealth\n - attack.t1036.005\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename|contains: '\\Photo Studio\\'\n TargetFilename|endswith:\n - '.js'\n - '.vbs'\n condition: selection\nfalsepositives:\n - Unlikely, no common legitimate application installs script files under a \"Photo Studio\" LocalAppData folder\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc541cda-266d-5b2b-a4c4-e32420a905c8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.877821Z", "modified": "2026-08-04T01:37:25.877821Z", "name": "WindowsUpdateService Scheduled Task Creation By Dotnet RAT Chain", "indicator_types": [ "malicious-activity" ], "pattern": "title: WindowsUpdateService Scheduled Task Creation By Dotnet RAT Chain\nid: 07502798-ce21-4812-86ca-3368b6f9f38c\nstatus: experimental\ndescription: >-\n Detects creation of a scheduled task named \"WindowsUpdateService\" configured to\n run at logon. This is the fileless .NET RAT chain's second persistence layer,\n created from inside the injected MSBuild.exe process after the Defender tamper\n step. This task name and mechanism are specific to the .NET RAT chain, the\n unrelated CloudSync Tor-panel RAT in the same toolkit persists only via a\n registry Run key and a Windows service, never a scheduled task.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.execution\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1053.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'schtasks'\n - '/tn'\n - 'WindowsUpdateService'\n - 'onlogon'\n condition: selection\nfalsepositives:\n - Unlikely, \"WindowsUpdateService\" is not a task name used by any genuine Windows Update component\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--585cb40e-8e43-5777-a39f-7a421328fc07", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.87812Z", "modified": "2026-08-04T01:37:25.87812Z", "name": "Temp Log File Deleted Matching Fileless Loader Staging Pattern", "indicator_types": [ "malicious-activity" ], "pattern": "title: Temp Log File Deleted Matching Fileless Loader Staging Pattern\nid: b237faa4-ae89-4f42-b5c7-d6c2d8b7f15b\nstatus: experimental\ndescription: >-\n Detects deletion of a temp file named \"log__\" from the user's\n Temp folder. The fileless .NET RAT loader decrypts its staged payload into a\n file of this name, reads it back into memory with PowerShell, then deletes it as\n anti-forensic cleanup, a temp file of this exact naming shape is not a pattern\n used by common legitimate logging utilities.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.stealth\n - attack.t1070.004\nlogsource:\n category: file_delete\n product: windows\ndetection:\n selection:\n TargetFilename|contains: '\\Temp\\log_'\n TargetFilename|re: '_[0-9]+_[0-9]+$'\n condition: selection\nfalsepositives:\n - Unknown, a coincidental temp filename matching the log__ shape from unrelated software has not been surveyed\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--194afb52-30db-5d60-abef-216cc0fd9603", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.878381Z", "modified": "2026-08-04T01:37:25.878381Z", "name": "Active Directory Tier-0 Backdoor Account Creation Or Privileged Group Addition", "indicator_types": [ "malicious-activity" ], "pattern": "title: Active Directory Tier-0 Backdoor Account Creation Or Privileged Group Addition\nid: b66c823b-08d3-4e03-8259-78257e98439c\nstatus: experimental\ndescription: >-\n Detects either the creation of a user account (not a computer account) whose\n sAMAccountName ends in a literal dollar sign, or the addition of any account to\n a Tier-0 privileged group (local Administrators, or the well-known Domain\n Admins/Enterprise Admins/Schema Admins relative IDs, matched by SID suffix so\n the rule is independent of OS locale and does not require the victim's domain\n name). Windows logs true computer-account creation under a separate event ID,\n so a dollar-suffixed name arriving via the user-account-creation event is itself\n the discriminator for a machine-account masquerade. Observed as an orchestrator\n tool's one-shot creation of a hidden \"Guest$\" account escalated into all four\n groups to build a forest-level backdoor.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1136.002\n - attack.t1098.007\nlogsource:\n product: windows\n service: security\ndetection:\n selection_create:\n EventID: 4720\n SamAccountName|contains: '$'\n selection_privgroup_domain:\n EventID:\n - 4728\n - 4756\n TargetSid|endswith:\n - '-512'\n - '-518'\n - '-519'\n selection_privgroup_local:\n EventID: 4732\n TargetSid: 'S-1-5-32-544'\n filter_main_homegroup:\n EventID: 4720\n TargetUserName: 'HomeGroupUser$'\n condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n - Legitimate onboarding of a new privileged administrator, or a genuine computer/service account naming collision with the dollar-sign check\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--68c9aa45-457a-5b9e-a410-cb586e754f93", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.878611Z", "modified": "2026-08-04T01:37:25.878611Z", "name": "Winlogon SpecialAccounts UserList Registry Write", "indicator_types": [ "malicious-activity" ], "pattern": "title: Winlogon SpecialAccounts UserList Registry Write\nid: 2966dbb8-8da1-492d-aeea-9921679ed4b6\nstatus: experimental\ndescription: >-\n Detects a write to the Winlogon SpecialAccounts\\UserList registry key, which\n hides the named account from the Windows logon screen and User Manager tile.\n This key is written almost exclusively to hide a newly created backdoor\n account, legitimate use (hiding a genuine service account) is rare enough that\n any write to this key merits review regardless of which account is targeted.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.stealth\n - attack.t1564.002\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|endswith: '\\SpecialAccounts\\UserList'\n condition: selection\nfalsepositives:\n - Deliberate administrative hiding of a legitimate local service account from the logon screen\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b02d60e-6510-5d3d-b18b-fc609eae79e9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.878815Z", "modified": "2026-08-04T01:37:25.878815Z", "name": "ASPX File Written to IIS aspnet_client Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: ASPX File Written to IIS aspnet_client Directory\nid: da35ea9d-176c-412e-9325-3df4f98a7033\nstatus: experimental\ndescription: >-\n Detects creation of an .aspx file inside an IIS aspnet_client directory. This\n path is reserved for a fixed set of Microsoft-shipped ASP.NET AJAX support\n files, not for uploaded or authored pages, any new .aspx file there is\n consistent with a web shell drop. Observed with the Sharp4WebCmd command-console\n web shell, dropped as the first stage of a post-compromise orchestrator tool.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename|contains: '\\aspnet_client\\'\n TargetFilename|endswith: '.aspx'\n condition: selection\nfalsepositives:\n - Unlikely, the aspnet_client directory does not normally receive new .aspx files after IIS/ASP.NET installation\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e35ee702-efcc-5ec7-85a7-b4e79e865e4c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.879064Z", "modified": "2026-08-04T01:37:25.879064Z", "name": "IIS Worker Process Spawning A Command Shell", "indicator_types": [ "malicious-activity" ], "pattern": "title: IIS Worker Process Spawning A Command Shell\nid: efdf846f-4879-4ee6-99e9-45a7203503a4\nstatus: experimental\ndescription: >-\n Detects the IIS worker process (w3wp.exe) spawning powershell.exe or cmd.exe.\n An IIS application pool process does not normally launch an interactive shell;\n this is the classic behavioral signal of a web shell being used to execute\n commands, observed here immediately after an ASPX web shell is dropped into the\n aspnet_client directory.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.execution\n - attack.t1505.003\n - attack.t1059.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\w3wp.exe'\n Image|endswith:\n - '\\powershell.exe'\n - '\\cmd.exe'\n condition: selection\nfalsepositives:\n - Rare IIS management or deployment automation that legitimately spawns a shell from the worker process\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--67bfccbe-bf69-50fe-ae74-1f52ed9cc1f3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.879282Z", "modified": "2026-08-04T01:37:25.879282Z", "name": "AnyDesk Unattended Password Piped Over Stdin By Non-AnyDesk Process", "indicator_types": [ "malicious-activity" ], "pattern": "title: AnyDesk Unattended Password Piped Over Stdin By Non-AnyDesk Process\nid: 944c365c-8565-4097-8d18-4e9a5f74aafe\nstatus: experimental\ndescription: >-\n Detects a command piping text into AnyDesk.exe with the --set-password flag\n the password value itself never appears on the command line, so the pipeline\n shape is the anchor. Observed issued by an orchestrator tool immediately after a\n silent, unattended AnyDesk install, to set a remote-access password without\n leaving the credential in process-creation logs.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n - https://redcanary.com/blog/misbehaving-rats/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.command-and-control\n - attack.t1219.002\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'echo'\n - 'AnyDesk.exe'\n - '--set-password'\n condition: selection\nfalsepositives:\n - Legitimate IT automation that pipes a password to AnyDesk during scripted unattended deployment\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea7ca0d0-0270-5679-8e18-58363adea101", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.879496Z", "modified": "2026-08-04T01:37:25.879496Z", "name": "PowerShell WebClient Download Inheriting Default Proxy Credentials", "indicator_types": [ "malicious-activity" ], "pattern": "title: PowerShell WebClient Download Inheriting Default Proxy Credentials\nid: 80dee74f-6c3d-4947-81bc-4fe1bb14f919\nstatus: experimental\ndescription: >-\n Detects a PowerShell Net.WebClient object configured with Proxy.Credentials set\n to DefaultCredentials, which inherits the logged-on user's authenticated proxy\n session so a payload download succeeds from inside an authenticated enterprise\n proxy. This is the deployment stub's always-present download stage, it fires\n even on runs where the subsequent payload write fails, since the stub gates its\n later stages on a successful save rather than a successful connection.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.command-and-control\n - attack.t1090\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'Net.WebClient'\n - 'Proxy.Credentials'\n - 'DefaultCredentials'\n condition: selection\nfalsepositives:\n - Unlikely, legitimate proxy-aware download scripts rarely combine WebClient with explicit DefaultCredentials proxy inheritance in this exact form\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f2584825-2b0f-587f-ae97-c23631841b49", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.879959Z", "modified": "2026-08-04T01:37:25.879959Z", "name": "AMSI Bypass Via AmsiUtils AmsiInitFailed Field SetValue", "indicator_types": [ "malicious-activity" ], "pattern": "title: AMSI Bypass Via AmsiUtils AmsiInitFailed Field SetValue\nid: f539cc09-bd50-4675-9119-08c09fb2ac24\nstatus: experimental\ndescription: >-\n Detects a PowerShell command that reflects into the AmsiUtils type and calls\n SetValue against a non-public static field to blind in-process AMSI scanning.\n Matched on the amsiInitFailed field name and the SetValue/NonPublic reflection\n call shape rather than the AmsiUtils type-name string, since the deployment stub\n observed in this campaign constructs that type name from a reversed string\n literal specifically to evade signature matching on the literal \"AmsiUtils\"\n substring.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.defense-impairment\n - attack.t1685\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'amsiInitFailed'\n - 'SetValue'\n - 'NonPublic'\n condition: selection\nfalsepositives:\n - Unlikely, legitimate scripts do not reflectively clear the AMSI initialization-failed field\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b09a55a5-afd6-52f5-9093-a460ef8b50ae", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.880205Z", "modified": "2026-08-04T01:37:25.880205Z", "name": "Run Key SystemUpdate Value Pointing To Startup Folder Tilde Executable", "indicator_types": [ "malicious-activity" ], "pattern": "title: Run Key SystemUpdate Value Pointing To Startup Folder Tilde Executable\nid: 3598bf78-f702-4ab3-b8ba-9d38f62eab80\nstatus: experimental\ndescription: >-\n Detects an HKCU Run value named \"SystemUpdate\" whose data points at a\n tilde-prefixed executable inside the user's Startup folder. This is the\n deployment stub's persistence step, added immediately after it copies its\n downloaded payload into Startup under a randomized ~.exe name.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1547.001\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|endswith: '\\CurrentVersion\\Run\\SystemUpdate'\n Details|contains: '\\Startup\\~'\n condition: selection\nfalsepositives:\n - Unlikely, the combination of the SystemUpdate value name and a Startup-folder tilde-prefixed target is not a known legitimate pattern\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f105f13e-d81e-5347-9b09-6f97765323c3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.88043Z", "modified": "2026-08-04T01:37:25.88043Z", "name": "Tilde Prefixed Executable Written To User Startup Folder", "indicator_types": [ "malicious-activity" ], "pattern": "title: Tilde Prefixed Executable Written To User Startup Folder\nid: 818f62ed-fba7-4252-97fd-234961f88eb5\nstatus: experimental\ndescription: >-\n Detects an executable with a tilde-prefixed filename written directly into a\n user's Startup folder. Broader and weaker in isolation than the paired\n SystemUpdate Run-key rule in this set, some installers briefly use\n tilde-prefixed temp names, though rarely inside the Startup folder itself, so\n this is intended for hunting and triage rather than standalone alerting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n - attack.persistence\n - attack.stealth\n - attack.t1036.005\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename|contains: '\\Start Menu\\Programs\\Startup\\~'\n TargetFilename|endswith: '.exe'\n condition: selection\nfalsepositives:\n - Installer temp-extraction artifacts that transiently use tilde-prefixed names\n - Legitimate portable applications that place a randomly-named launcher shortcut in Startup\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--90a2a481-8241-5862-bec0-0e687eca2955", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.880688Z", "modified": "2026-08-04T01:37:25.880688Z", "name": "THL HUNT CloudSync-Assembler-Toolkit AUTO UPDATE C2 Registration Marker (C2 Registration)", "indicator_types": [ "malicious-activity" ], "pattern": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT CloudSync-Assembler-Toolkit AUTO UPDATE C2 Registration Marker (C2 Registration)\"; flow:established,to_server; content:\"=== AUTO UPDATE ===\"; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000001; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-03, reference https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/;)", "pattern_type": "suricata", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e52b8888-f173-57a1-bd34-40f54cedeebb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.88097Z", "modified": "2026-08-04T01:37:25.88097Z", "name": "THL HUNT CloudSync-Assembler-Toolkit Shares Heartbeat Terminator Marker (C2 Heartbeat)", "indicator_types": [ "malicious-activity" ], "pattern": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT CloudSync-Assembler-Toolkit Shares Heartbeat Terminator Marker (C2 Heartbeat)\"; flow:established,to_server; content:\"[Shares]\"; pcre:\"/\\[(C2_END|END)\\]/\"; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000002; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-03, reference https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/;)", "pattern_type": "suricata", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0a0add0c-c85a-55ca-b499-522b5769129a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.881203Z", "modified": "2026-08-04T01:37:25.881203Z", "name": "THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun TLS SNI (Sourced Commodity Stealer C2)", "indicator_types": [ "malicious-activity" ], "pattern": "alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun TLS SNI (Sourced Commodity Stealer C2)\"; flow:established,to_server; tls.sni; content:\"c3lestial.fun\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000003; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-03, reference https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/;)", "pattern_type": "suricata", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d39d8a3d-469a-57b4-b940-8691dd49457b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.881495Z", "modified": "2026-08-04T01:37:25.881495Z", "name": "THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun DNS Query (Sourced Commodity Stealer C2)", "indicator_types": [ "malicious-activity" ], "pattern": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun DNS Query (Sourced Commodity Stealer C2)\"; dns_query; content:\"c3lestial.fun\"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000004; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-03, reference https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/;)", "pattern_type": "suricata", "valid_from": "2026-08-03T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--953777c1-e01d-568e-9445-216014181b50", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.881763Z", "modified": "2026-08-04T01:37:25.881763Z", "name": "CloudSync", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--a9829532-574f-576c-a184-bc3fb651525d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.882095Z", "modified": "2026-08-04T01:37:25.882095Z", "name": "SvchostPayload (.NET RAT)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.882302Z", "modified": "2026-08-04T01:37:25.882302Z", "name": "SentinelStealer", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--4634c541-7106-53c9-b6f3-c0bdd766cdea", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.882869Z", "modified": "2026-08-04T01:37:25.882869Z", "name": "client.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--2fbfcdfd-577d-5687-b84d-b5a4ea4b5c6f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.883127Z", "modified": "2026-08-04T01:37:25.883127Z", "name": "q.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--c6eb08b6-15b4-513c-95be-9357dcb80814", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.883322Z", "modified": "2026-08-04T01:37:25.883322Z", "name": "s.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--441c3e1d-874b-5c20-8f90-a4f576240adf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.8835Z", "modified": "2026-08-04T01:37:25.8835Z", "name": "bk.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--8c58dc7a-d99e-58c2-992c-0f0427c66a3d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.883807Z", "modified": "2026-08-04T01:37:25.883807Z", "name": "svhost4.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--6c36af25-2513-5dea-97b7-6c88dbdecc89", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.883978Z", "modified": "2026-08-04T01:37:25.883978Z", "name": "ab.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--396fc653-f1cf-5954-b412-d2d80e8cd84f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884158Z", "modified": "2026-08-04T01:37:25.884158Z", "name": "ct.bat", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--22b30454-aeee-5141-9b04-2e88ec06bc35", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884275Z", "modified": "2026-08-04T01:37:25.884275Z", "name": "svhost.js", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--fa256b38-12b1-5955-aa73-934fa95c41dd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884413Z", "modified": "2026-08-04T01:37:25.884413Z", "name": "rr.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--c6750e0f-6848-5055-840e-6624bb6ba197", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884566Z", "modified": "2026-08-04T01:37:25.884566Z", "name": "SvchostPayload", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--5c0144d7-9fb5-563a-962f-2a656247fd49", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884695Z", "modified": "2026-08-04T01:37:25.884695Z", "name": "Crystal-Monk.dll", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--04ab9a36-6c1f-5b7a-b7e4-f392a7d600c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.884942Z", "modified": "2026-08-04T01:37:25.884942Z", "name": "cls.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5743605a-3d87-5989-8a8b-73446c9ec5d3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.885189Z", "modified": "2026-08-04T01:37:25.885189Z", "name": "Replication Through Removable Media", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1091", "external_id": "T1091" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.885576Z", "modified": "2026-08-04T01:37:25.885576Z", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/007", "external_id": "T1059.007" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.885808Z", "modified": "2026-08-04T01:37:25.885808Z", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/001", "external_id": "T1059.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886026Z", "modified": "2026-08-04T01:37:25.886026Z", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1053/005", "external_id": "T1053.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.8862Z", "modified": "2026-08-04T01:37:25.8862Z", "name": "Registry Run Keys / Startup Folder", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/001", "external_id": "T1547.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886383Z", "modified": "2026-08-04T01:37:25.886383Z", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1543/003", "external_id": "T1543.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c1d4cd2d-a87a-5026-9a32-1b3f8f09459b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886519Z", "modified": "2026-08-04T01:37:25.886519Z", "name": "Create Account: Domain Account", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1136/002", "external_id": "T1136.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7373eec5-e966-5e5e-8010-488ee0ec6942", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886653Z", "modified": "2026-08-04T01:37:25.886653Z", "name": "Create Account: Local Account", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1136/001", "external_id": "T1136.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886782Z", "modified": "2026-08-04T01:37:25.886782Z", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1505/003", "external_id": "T1505.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--78cb525e-55ae-5185-8b31-d245bb9532cd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.886947Z", "modified": "2026-08-04T01:37:25.886947Z", "name": "Account Manipulation", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1098", "external_id": "T1098" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2a264b9c-3fd7-5eeb-9ade-d73008a13713", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887081Z", "modified": "2026-08-04T01:37:25.887081Z", "name": "Remote Access Software", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1219", "external_id": "T1219" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887226Z", "modified": "2026-08-04T01:37:25.887226Z", "name": "Process Injection", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1055", "external_id": "T1055" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--19b23d6f-0fe0-53c3-b371-c7532e505132", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887388Z", "modified": "2026-08-04T01:37:25.887388Z", "name": "Trusted Developer Utilities: MSBuild", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1127/001", "external_id": "T1127.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887593Z", "modified": "2026-08-04T01:37:25.887593Z", "name": "Reflective Code Loading", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1620", "external_id": "T1620" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887789Z", "modified": "2026-08-04T01:37:25.887789Z", "name": "Impair Defenses: Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1562/001", "external_id": "T1562.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c6fbe48-7b7a-543c-a547-e7de90a8db6c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.887953Z", "modified": "2026-08-04T01:37:25.887953Z", "name": "Hidden Users", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1564/002", "external_id": "T1564.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.888089Z", "modified": "2026-08-04T01:37:25.888089Z", "name": "Match Legitimate Name or Location", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1036/005", "external_id": "T1036.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4d78476e-e20d-514e-afd4-b91af65314cc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.888224Z", "modified": "2026-08-04T01:37:25.888224Z", "name": "Indicator Removal", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1070", "external_id": "T1070" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b41e6891-97a9-552c-8eb3-afaa1f79e9d4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.888392Z", "modified": "2026-08-04T01:37:25.888392Z", "name": "Credentials from Web Browsers", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1555/003", "external_id": "T1555.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.88853Z", "modified": "2026-08-04T01:37:25.88853Z", "name": "Keylogging", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1056/001", "external_id": "T1056.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4cbca60b-20d4-5fd7-8e70-29e9475fa89f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.888678Z", "modified": "2026-08-04T01:37:25.888678Z", "name": "Network Service Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046", "external_id": "T1046" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ba2d866b-110d-5350-8c82-dbc17d7abad3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.88883Z", "modified": "2026-08-04T01:37:25.88883Z", "name": "Network Share Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1135", "external_id": "T1135" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.888997Z", "modified": "2026-08-04T01:37:25.888997Z", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889167Z", "modified": "2026-08-04T01:37:25.889167Z", "name": "SMB/Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1021/002", "external_id": "T1021.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--519ad548-2612-50a9-b36f-4c734818a1e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889335Z", "modified": "2026-08-04T01:37:25.889335Z", "name": "Screen Capture", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1113", "external_id": "T1113" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a08f8085-d76d-5961-9cc5-38087943d6db", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889469Z", "modified": "2026-08-04T01:37:25.889469Z", "name": "Audio Capture", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1123", "external_id": "T1123" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--343c48ab-a3c6-5ff7-b6e7-3dd92d069ca8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889601Z", "modified": "2026-08-04T01:37:25.889601Z", "name": "Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1071", "external_id": "T1071" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889753Z", "modified": "2026-08-04T01:37:25.889753Z", "name": "Multi-hop Proxy (per-victim Tor hidden service)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1090/003", "external_id": "T1090.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.889912Z", "modified": "2026-08-04T01:37:25.889912Z", "name": "Non-Standard Port", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1571", "external_id": "T1571" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.890128Z", "modified": "2026-08-04T01:37:25.890128Z", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1105", "external_id": "T1105" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--351c2bb8-092f-5863-b623-f9ca08b16432", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.890359Z", "modified": "2026-08-04T01:37:25.890359Z", "name": "Web Service (Telegram notify)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1102", "external_id": "T1102" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.890892Z", "modified": "2026-08-04T01:37:25.890892Z", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1041", "external_id": "T1041" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--22f52dfa-fe20-5523-af01-ffdf35256f72", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.891097Z", "modified": "2026-08-04T01:37:25.891097Z", "name": "cloudsync-assembler-toolkit-91-197-98-188 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f54447d6-024b-5bec-8cd8-ee7ab319ffcd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.892005Z", "modified": "2026-08-04T01:37:25.892005Z", "relationship_type": "indicates", "source_ref": "indicator--8283b415-7124-5749-baaf-6fdc09a16ecf", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43d99a34-c329-5dba-892a-558309947deb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.892517Z", "modified": "2026-08-04T01:37:25.892517Z", "relationship_type": "indicates", "source_ref": "indicator--27ebf16a-7afb-514f-8c0c-460fa72a4dc6", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9eca5e05-1947-5415-9d6e-97d7d199273a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.892673Z", "modified": "2026-08-04T01:37:25.892673Z", "relationship_type": "indicates", "source_ref": "indicator--cc0fd9f4-b13c-5253-bd85-adb3d6784e68", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--807ec3ec-a640-5054-8a74-fb6bebae0a1f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.892812Z", "modified": "2026-08-04T01:37:25.892812Z", "relationship_type": "indicates", "source_ref": "indicator--20a11a24-904c-52a1-af61-880d4ba64c2a", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e009c63f-27f1-5c44-93e3-eea2ba9667c3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.892977Z", "modified": "2026-08-04T01:37:25.892977Z", "relationship_type": "indicates", "source_ref": "indicator--a6801bf7-4893-5b1a-b89a-d7b5fadf91f4", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18161b3b-f057-525e-9681-4f9b1d5aeebf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893125Z", "modified": "2026-08-04T01:37:25.893125Z", "relationship_type": "indicates", "source_ref": "indicator--21158ea7-c877-53d7-ad58-e7c05f9ceb0b", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b9c5f89-5857-52a4-9fa1-eff3d5b530f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893249Z", "modified": "2026-08-04T01:37:25.893249Z", "relationship_type": "indicates", "source_ref": "indicator--893e239a-a5dd-56bc-a561-9c79952cc75b", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5143bf0d-e440-5664-8feb-96066deceaa9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893459Z", "modified": "2026-08-04T01:37:25.893459Z", "relationship_type": "indicates", "source_ref": "indicator--78b34948-9a84-548e-b370-cd602bfd3367", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ca95b9a0-db1e-5f62-8979-62368b96f66f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893629Z", "modified": "2026-08-04T01:37:25.893629Z", "relationship_type": "indicates", "source_ref": "indicator--3832238b-e9ff-5b1b-9c62-6315c3bd64e2", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2879f22-6642-52c2-91f9-766aff7753f6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893762Z", "modified": "2026-08-04T01:37:25.893762Z", "relationship_type": "indicates", "source_ref": "indicator--f482c958-8d70-57c2-9dad-cd0c7c24061b", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--46ebeb16-fd37-5b38-9022-4da947ee2793", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.893931Z", "modified": "2026-08-04T01:37:25.893931Z", "relationship_type": "indicates", "source_ref": "indicator--905535be-fa82-5642-80b4-d05d43708b7e", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e28466f-fab0-5635-85c2-5b4a158e2208", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894092Z", "modified": "2026-08-04T01:37:25.894092Z", "relationship_type": "indicates", "source_ref": "indicator--57ed259c-002b-5786-96ce-12fd1fb8d493", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1db35d42-0675-57e3-9d77-7c63ede48281", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894205Z", "modified": "2026-08-04T01:37:25.894205Z", "relationship_type": "indicates", "source_ref": "indicator--4d5b2dde-07e9-5752-89df-4d26f63d2131", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1648dd4f-699d-5af7-be83-7b9f2e1bb8d3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894339Z", "modified": "2026-08-04T01:37:25.894339Z", "relationship_type": "indicates", "source_ref": "indicator--1432aab7-b938-55b1-82d9-f5f25a0114ca", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea183df8-06d8-5250-88ed-b9c8361ce210", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894448Z", "modified": "2026-08-04T01:37:25.894448Z", "relationship_type": "indicates", "source_ref": "indicator--a235c665-2aab-5d95-a724-38e6eca63144", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4aa9362f-d8b4-5ad3-9295-fdf2550b1236", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894589Z", "modified": "2026-08-04T01:37:25.894589Z", "relationship_type": "indicates", "source_ref": "indicator--59ba7a73-34c5-5942-a725-fa753d9071b4", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f25a3ca6-f347-5aa9-85f5-a7aa1ad89fda", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894711Z", "modified": "2026-08-04T01:37:25.894711Z", "relationship_type": "indicates", "source_ref": "indicator--fb98c2b6-0f68-55d1-990e-1e4241aafd43", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c9bc8d7-d841-55b4-a9a5-003d61755905", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.894909Z", "modified": "2026-08-04T01:37:25.894909Z", "relationship_type": "indicates", "source_ref": "indicator--03ca9929-1c95-56df-88c4-5b035e89bdfd", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20533762-689f-51a2-ae08-46a3f6b279b0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895077Z", "modified": "2026-08-04T01:37:25.895077Z", "relationship_type": "indicates", "source_ref": "indicator--e68dec58-880d-5780-8266-e9143fb2e90a", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b13fb2b0-68d8-5f01-bda3-df3aead75065", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895223Z", "modified": "2026-08-04T01:37:25.895223Z", "relationship_type": "indicates", "source_ref": "indicator--edd8bea6-b5de-5b46-acdd-0d6168e94e1f", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f2e21ee9-b0ee-5fc8-a111-13c6bb99576a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895431Z", "modified": "2026-08-04T01:37:25.895431Z", "relationship_type": "indicates", "source_ref": "indicator--47fcbba0-311e-567f-8c06-bf382699acc6", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a5b1decd-c245-55b6-846b-a8a058e9a331", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895543Z", "modified": "2026-08-04T01:37:25.895543Z", "relationship_type": "indicates", "source_ref": "indicator--fc541cda-266d-5b2b-a4c4-e32420a905c8", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66e7a5ec-e2f8-5942-a12d-6c7eb5851600", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895651Z", "modified": "2026-08-04T01:37:25.895651Z", "relationship_type": "indicates", "source_ref": "indicator--585cb40e-8e43-5777-a39f-7a421328fc07", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e71f9198-628a-5a6e-bca9-e7a78c904a16", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895761Z", "modified": "2026-08-04T01:37:25.895761Z", "relationship_type": "indicates", "source_ref": "indicator--194afb52-30db-5d60-abef-216cc0fd9603", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3422d4ae-10e6-5f7b-8e73-143b4586140c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895871Z", "modified": "2026-08-04T01:37:25.895871Z", "relationship_type": "indicates", "source_ref": "indicator--68c9aa45-457a-5b9e-a410-cb586e754f93", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--994c0846-c22e-5c16-870d-5494d337298c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.895976Z", "modified": "2026-08-04T01:37:25.895976Z", "relationship_type": "indicates", "source_ref": "indicator--5b02d60e-6510-5d3d-b18b-fc609eae79e9", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4d206ca-c8a1-58a6-a40c-fa4ba595ee39", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896102Z", "modified": "2026-08-04T01:37:25.896102Z", "relationship_type": "indicates", "source_ref": "indicator--e35ee702-efcc-5ec7-85a7-b4e79e865e4c", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b585ac7-fc50-5915-91d9-f77ae39ff709", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896218Z", "modified": "2026-08-04T01:37:25.896218Z", "relationship_type": "indicates", "source_ref": "indicator--67bfccbe-bf69-50fe-ae74-1f52ed9cc1f3", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39f4e215-4535-5df0-8f15-784c8297f83d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896375Z", "modified": "2026-08-04T01:37:25.896375Z", "relationship_type": "indicates", "source_ref": "indicator--ea7ca0d0-0270-5679-8e18-58363adea101", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae906f6d-7ac4-55de-bec8-47be4dfdf907", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896534Z", "modified": "2026-08-04T01:37:25.896534Z", "relationship_type": "indicates", "source_ref": "indicator--f2584825-2b0f-587f-ae97-c23631841b49", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f623d0e3-494d-55bf-b996-6994451ca5e7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896647Z", "modified": "2026-08-04T01:37:25.896647Z", "relationship_type": "indicates", "source_ref": "indicator--b09a55a5-afd6-52f5-9093-a460ef8b50ae", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7541a68a-b363-5cbc-9e2c-f5ca28355bef", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896771Z", "modified": "2026-08-04T01:37:25.896771Z", "relationship_type": "indicates", "source_ref": "indicator--f105f13e-d81e-5347-9b09-6f97765323c3", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a031e736-92c8-5827-99ee-c49a75985ec5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.896932Z", "modified": "2026-08-04T01:37:25.896932Z", "relationship_type": "indicates", "source_ref": "indicator--90a2a481-8241-5862-bec0-0e687eca2955", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be1be9e9-0fe0-5379-9352-282f4969955b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.89708Z", "modified": "2026-08-04T01:37:25.89708Z", "relationship_type": "indicates", "source_ref": "indicator--e52b8888-f173-57a1-bd34-40f54cedeebb", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d140fa41-37fc-58b8-9135-f320784310fd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897192Z", "modified": "2026-08-04T01:37:25.897192Z", "relationship_type": "indicates", "source_ref": "indicator--0a0add0c-c85a-55ca-b499-522b5769129a", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dffe86a6-5e19-5a2d-a6fb-bc98f0120594", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897347Z", "modified": "2026-08-04T01:37:25.897347Z", "relationship_type": "indicates", "source_ref": "indicator--d39d8a3d-469a-57b4-b940-8691dd49457b", "target_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3f4a74c-4856-5cfe-b4b4-65321ed7f955", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897467Z", "modified": "2026-08-04T01:37:25.897467Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--5743605a-3d87-5989-8a8b-73446c9ec5d3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00132be3-a02b-5965-b5a2-9dcac1257fc1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897588Z", "modified": "2026-08-04T01:37:25.897588Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9c97a55-092a-5e1d-a4c2-cd2f24178be4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897711Z", "modified": "2026-08-04T01:37:25.897711Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a29bd003-95a4-5903-a8c6-a41975fd8569", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897857Z", "modified": "2026-08-04T01:37:25.897857Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b359ad9-8b6f-5ac9-907f-c22f7708755d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.897991Z", "modified": "2026-08-04T01:37:25.897991Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87f36d6f-2e4e-52f6-8d25-fd9f33d1accf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.898137Z", "modified": "2026-08-04T01:37:25.898137Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7fe9e07-577e-5a8a-b99e-8d82809b17d4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.898279Z", "modified": "2026-08-04T01:37:25.898279Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--c1d4cd2d-a87a-5026-9a32-1b3f8f09459b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4c9e59a2-2bf0-58c4-bdfa-c53eed445cb7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.898395Z", "modified": "2026-08-04T01:37:25.898395Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--7373eec5-e966-5e5e-8010-488ee0ec6942", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--753cb6b9-a071-589f-a2f1-546e107be17a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.898507Z", "modified": "2026-08-04T01:37:25.898507Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ba71dcb-2634-5a01-8868-725e45951dcd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.89862Z", "modified": "2026-08-04T01:37:25.89862Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--78cb525e-55ae-5185-8b31-d245bb9532cd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--afe21149-9f28-593f-a0ac-fab59a2f6231", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.89873Z", "modified": "2026-08-04T01:37:25.89873Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--2a264b9c-3fd7-5eeb-9ade-d73008a13713", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce44b449-7234-5f9e-b4ce-e3cd9aeeef53", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.89886Z", "modified": "2026-08-04T01:37:25.89886Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--82b7e4dc-03bd-5dd8-8838-525ff4eab532", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899002Z", "modified": "2026-08-04T01:37:25.899002Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--19b23d6f-0fe0-53c3-b371-c7532e505132", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1e6078da-ee67-5f8e-9540-7b10b0e3a336", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899237Z", "modified": "2026-08-04T01:37:25.899237Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--64339d45-b190-5fb6-8c17-a78e2c156e34", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899379Z", "modified": "2026-08-04T01:37:25.899379Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ec63ab7-e355-5cd0-91cf-538ae37263d6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899549Z", "modified": "2026-08-04T01:37:25.899549Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--8c6fbe48-7b7a-543c-a547-e7de90a8db6c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7328b166-9f6b-50ca-b3c6-ef27412220cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899725Z", "modified": "2026-08-04T01:37:25.899725Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c1fd766-5e83-5f44-8040-ea74f25ee667", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.899897Z", "modified": "2026-08-04T01:37:25.899897Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--4d78476e-e20d-514e-afd4-b91af65314cc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f588f741-e065-5f11-8e46-63b57ffe9302", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900012Z", "modified": "2026-08-04T01:37:25.900012Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--b41e6891-97a9-552c-8eb3-afaa1f79e9d4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51aaf5ba-d5d4-5be1-8054-cfd5d3bbfd51", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900138Z", "modified": "2026-08-04T01:37:25.900138Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a028250-b3f5-56a0-a4ea-8a1d3aa5bcee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90025Z", "modified": "2026-08-04T01:37:25.90025Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--4cbca60b-20d4-5fd7-8e70-29e9475fa89f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba683a13-e744-5274-951b-877ab902e865", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900362Z", "modified": "2026-08-04T01:37:25.900362Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--ba2d866b-110d-5350-8c82-dbc17d7abad3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da083691-937d-58e5-925c-ef213ec0bff2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900495Z", "modified": "2026-08-04T01:37:25.900495Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1734f846-160e-53ba-860c-cb2b4c95c5f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900614Z", "modified": "2026-08-04T01:37:25.900614Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c83f881e-0308-58a5-b66e-8a5bb035aeb9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900726Z", "modified": "2026-08-04T01:37:25.900726Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--519ad548-2612-50a9-b36f-4c734818a1e0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--963e4b4e-0a73-558d-aaf6-e814fdf6b49a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900848Z", "modified": "2026-08-04T01:37:25.900848Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--a08f8085-d76d-5961-9cc5-38087943d6db", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2d9a1db-8237-5a5f-b733-0e6fc05b0687", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.900998Z", "modified": "2026-08-04T01:37:25.900998Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--343c48ab-a3c6-5ff7-b6e7-3dd92d069ca8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bba67c68-3e09-5803-afca-3606d122cddf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901156Z", "modified": "2026-08-04T01:37:25.901156Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--412c87e0-4bbe-527b-b88f-ff05a69a329d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901309Z", "modified": "2026-08-04T01:37:25.901309Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16a6cb9b-805e-55a6-8c96-43fb17c78ece", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901418Z", "modified": "2026-08-04T01:37:25.901418Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7477145c-777e-5aa6-a5a8-f34d37c76dbe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901554Z", "modified": "2026-08-04T01:37:25.901554Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--351c2bb8-092f-5863-b623-f9ca08b16432", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9ba0ef8-aeb3-5e16-ac0a-f0dcc584fc2a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90167Z", "modified": "2026-08-04T01:37:25.90167Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--04125bfb-f1b1-5114-a2c8-09713edade45", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901776Z", "modified": "2026-08-04T01:37:25.901776Z", "relationship_type": "uses", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "infrastructure--22f52dfa-fe20-5523-af01-ffdf35256f72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89a61867-0570-5a60-81f2-afd1dccd1c00", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.901912Z", "modified": "2026-08-04T01:37:25.901912Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--5743605a-3d87-5989-8a8b-73446c9ec5d3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2dc0e958-2113-5f26-a6ba-721d5b2641cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902033Z", "modified": "2026-08-04T01:37:25.902033Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eec361dd-ab0c-5436-b402-428bc5b6c4d6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90215Z", "modified": "2026-08-04T01:37:25.90215Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9850281c-7099-5d53-bdb8-a01137cd7431", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902259Z", "modified": "2026-08-04T01:37:25.902259Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fdbdb4c2-b075-5161-9576-69befd6ef2c8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902374Z", "modified": "2026-08-04T01:37:25.902374Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e41cabd-b38d-563d-9ad5-4632f85d7634", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902532Z", "modified": "2026-08-04T01:37:25.902532Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2c6f96e-1a59-53a2-bafc-a0426a2fb8e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902724Z", "modified": "2026-08-04T01:37:25.902724Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--c1d4cd2d-a87a-5026-9a32-1b3f8f09459b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4e13065-57b6-5f87-9681-ba921178b9ce", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.902904Z", "modified": "2026-08-04T01:37:25.902904Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--7373eec5-e966-5e5e-8010-488ee0ec6942", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38e613c9-5142-5d33-b5a4-fa0124ef7acb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903061Z", "modified": "2026-08-04T01:37:25.903061Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91f57a4b-e29e-5d47-981c-c8d93187e543", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903207Z", "modified": "2026-08-04T01:37:25.903207Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--78cb525e-55ae-5185-8b31-d245bb9532cd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af1cd129-0e7a-540e-8b78-07697cbe34b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903336Z", "modified": "2026-08-04T01:37:25.903336Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--2a264b9c-3fd7-5eeb-9ade-d73008a13713", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec690657-2feb-5ba0-a339-f6820c8a44e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903444Z", "modified": "2026-08-04T01:37:25.903444Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--371b3682-7faf-5000-818f-826e4fc1b925", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903549Z", "modified": "2026-08-04T01:37:25.903549Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--19b23d6f-0fe0-53c3-b371-c7532e505132", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ce81cab-d35c-579c-bb3f-fa3ee61a0e01", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903677Z", "modified": "2026-08-04T01:37:25.903677Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b089cec-2208-5cc6-8860-2bca623db9a1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.903901Z", "modified": "2026-08-04T01:37:25.903901Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c3df7500-7604-5180-a7a7-c8e0f59b5574", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.904114Z", "modified": "2026-08-04T01:37:25.904114Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--8c6fbe48-7b7a-543c-a547-e7de90a8db6c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--decb01c3-92de-56cc-af01-fb0224fbf97d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.904304Z", "modified": "2026-08-04T01:37:25.904304Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8260341a-8036-5687-8df3-dac3c4e1992f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.904484Z", "modified": "2026-08-04T01:37:25.904484Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--4d78476e-e20d-514e-afd4-b91af65314cc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--501851e0-62f2-5a42-b477-3f6966d4e6fe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.904663Z", "modified": "2026-08-04T01:37:25.904663Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--b41e6891-97a9-552c-8eb3-afaa1f79e9d4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee4a88ba-5d54-52a4-be07-6dbbb0f4ffb7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.904887Z", "modified": "2026-08-04T01:37:25.904887Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8fb8843e-0bd6-5339-b39e-f02e5b529477", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905084Z", "modified": "2026-08-04T01:37:25.905084Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--4cbca60b-20d4-5fd7-8e70-29e9475fa89f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93dd7924-b1d3-51ac-9050-242d15d88f78", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905262Z", "modified": "2026-08-04T01:37:25.905262Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--ba2d866b-110d-5350-8c82-dbc17d7abad3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0071c6f9-0c2e-5a1b-94bd-519199514c95", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905435Z", "modified": "2026-08-04T01:37:25.905435Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb51f0fe-4007-5bf5-912f-725eceefe284", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905604Z", "modified": "2026-08-04T01:37:25.905604Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50fc8c50-821d-5a3b-b943-e1ed87443d82", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905758Z", "modified": "2026-08-04T01:37:25.905758Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--519ad548-2612-50a9-b36f-4c734818a1e0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b7f43c7-d8ac-553c-b30d-3b6bf91712d6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.905904Z", "modified": "2026-08-04T01:37:25.905904Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--a08f8085-d76d-5961-9cc5-38087943d6db", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ac40f6a-d065-54ec-bd9c-c480c942a511", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.906023Z", "modified": "2026-08-04T01:37:25.906023Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--343c48ab-a3c6-5ff7-b6e7-3dd92d069ca8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74d9d3dc-3e66-5c6d-b857-9d9d1f9f6faf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.906208Z", "modified": "2026-08-04T01:37:25.906208Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74c6f9ec-16ea-5ebd-a14d-861300801b14", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.906393Z", "modified": "2026-08-04T01:37:25.906393Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--59868de6-71d6-5aad-a688-3031784e4fe3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90657Z", "modified": "2026-08-04T01:37:25.90657Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e25ce7b5-0a00-5a0c-8b01-c8ab49ac16c8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.906746Z", "modified": "2026-08-04T01:37:25.906746Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--351c2bb8-092f-5863-b623-f9ca08b16432", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51cfb890-2031-5e24-9a53-7a72d8cf4262", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90701Z", "modified": "2026-08-04T01:37:25.90701Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71703299-fc28-5c22-9649-ff96e8b986a0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907176Z", "modified": "2026-08-04T01:37:25.907176Z", "relationship_type": "uses", "source_ref": "malware--a9829532-574f-576c-a184-bc3fb651525d", "target_ref": "infrastructure--22f52dfa-fe20-5523-af01-ffdf35256f72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86857d24-cecc-506d-82c0-42525c8cf443", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907309Z", "modified": "2026-08-04T01:37:25.907309Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--5743605a-3d87-5989-8a8b-73446c9ec5d3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2d6b2207-0a80-5284-b7a6-8b1183aaf2d1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907429Z", "modified": "2026-08-04T01:37:25.907429Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--316c5425-5e53-5ce5-86df-2ec6ea355b49", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907548Z", "modified": "2026-08-04T01:37:25.907548Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0456d4f3-b493-5586-9329-f5f4f5e5baad", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907663Z", "modified": "2026-08-04T01:37:25.907663Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9af68ff-8e6d-542a-a68a-566a0be8be72", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907779Z", "modified": "2026-08-04T01:37:25.907779Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2eb66e4b-a436-5675-94b0-e5e5861b3a95", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.907953Z", "modified": "2026-08-04T01:37:25.907953Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c6ade71d-acd8-5f13-b581-b7e3f754bc84", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90808Z", "modified": "2026-08-04T01:37:25.90808Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--c1d4cd2d-a87a-5026-9a32-1b3f8f09459b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e0ea4b4-ff0c-50b4-a0f0-708ad81a45e8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.908199Z", "modified": "2026-08-04T01:37:25.908199Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--7373eec5-e966-5e5e-8010-488ee0ec6942", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b373df46-99af-5021-8cca-1380286a978b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90835Z", "modified": "2026-08-04T01:37:25.90835Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5c98c0f-6ad4-51e4-8991-cea3f21a0d47", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.908473Z", "modified": "2026-08-04T01:37:25.908473Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--78cb525e-55ae-5185-8b31-d245bb9532cd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c89fc7b7-bd45-5ab6-b949-fe2619fce2f4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.908619Z", "modified": "2026-08-04T01:37:25.908619Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--2a264b9c-3fd7-5eeb-9ade-d73008a13713", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3f746fd-4488-582b-b88b-3f23e5d273b2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.908786Z", "modified": "2026-08-04T01:37:25.908786Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7923d176-7b99-56d9-8e98-e7e2e9c9cc02", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.909044Z", "modified": "2026-08-04T01:37:25.909044Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--19b23d6f-0fe0-53c3-b371-c7532e505132", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--11a81d79-b270-5126-924f-40e79aa60aac", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.909296Z", "modified": "2026-08-04T01:37:25.909296Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1dbb061a-4126-51b7-8dde-9218f96881bb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90943Z", "modified": "2026-08-04T01:37:25.90943Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3efb4274-abfd-5198-a540-27f65c66992d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.909573Z", "modified": "2026-08-04T01:37:25.909573Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--8c6fbe48-7b7a-543c-a547-e7de90a8db6c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c9d1c91-8a34-5c28-bc3a-cd50ccc790d7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.909686Z", "modified": "2026-08-04T01:37:25.909686Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--238dbbc2-d9da-589b-b681-573e3d56144e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.909792Z", "modified": "2026-08-04T01:37:25.909792Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--4d78476e-e20d-514e-afd4-b91af65314cc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fefb843e-6de6-5324-b98f-51ce22d1567c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.90991Z", "modified": "2026-08-04T01:37:25.90991Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--b41e6891-97a9-552c-8eb3-afaa1f79e9d4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29974a04-a2a7-5e54-9f95-f793daca8d24", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91002Z", "modified": "2026-08-04T01:37:25.91002Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25c1fbbd-54b4-573c-a04c-f9e00a92bfa2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91015Z", "modified": "2026-08-04T01:37:25.91015Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--4cbca60b-20d4-5fd7-8e70-29e9475fa89f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f865ebb-13d6-5da2-ac00-f9c936956157", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.910268Z", "modified": "2026-08-04T01:37:25.910268Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--ba2d866b-110d-5350-8c82-dbc17d7abad3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00eeb566-42d9-5bee-821e-ef382def4fed", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.910418Z", "modified": "2026-08-04T01:37:25.910418Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c1a7aa7-45de-54f3-ae21-ae11255c6f88", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.910564Z", "modified": "2026-08-04T01:37:25.910564Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a4d12ed-39f8-5b15-824d-378222f8e12c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.910687Z", "modified": "2026-08-04T01:37:25.910687Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--519ad548-2612-50a9-b36f-4c734818a1e0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4abe10f-20d0-5185-b42d-75841171d92d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.9108Z", "modified": "2026-08-04T01:37:25.9108Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--a08f8085-d76d-5961-9cc5-38087943d6db", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71d8778f-fd90-5b98-beed-f72eacdfebae", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.910912Z", "modified": "2026-08-04T01:37:25.910912Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--343c48ab-a3c6-5ff7-b6e7-3dd92d069ca8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4681bf2-6d45-5304-8007-e3a7af4e65f8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911028Z", "modified": "2026-08-04T01:37:25.911028Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24651a0f-1f73-5f7f-99e9-15669ac8be32", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91115Z", "modified": "2026-08-04T01:37:25.91115Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--137334ee-120b-5d9a-acea-6a97fe592057", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911263Z", "modified": "2026-08-04T01:37:25.911263Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--82f339f5-955c-5416-bdf6-77f6657965a2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911371Z", "modified": "2026-08-04T01:37:25.911371Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--351c2bb8-092f-5863-b623-f9ca08b16432", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ecc094d9-1862-5c19-a727-a876caff53d8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911476Z", "modified": "2026-08-04T01:37:25.911476Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0bb2292-a594-5e7a-8c9f-665f5b4b0dc0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911649Z", "modified": "2026-08-04T01:37:25.911649Z", "relationship_type": "uses", "source_ref": "malware--135e856e-418d-5dba-99b0-6da5eb736158", "target_ref": "infrastructure--22f52dfa-fe20-5523-af01-ffdf35256f72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a80bf91d-1af6-53e5-948c-b3a0f4c77d14", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91178Z", "modified": "2026-08-04T01:37:25.91178Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--4634c541-7106-53c9-b6f3-c0bdd766cdea", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba40f65c-fb28-5bf4-911a-257380b8ee16", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.911905Z", "modified": "2026-08-04T01:37:25.911905Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--2fbfcdfd-577d-5687-b84d-b5a4ea4b5c6f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9759067-aded-5315-836b-28701c2f6a38", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912025Z", "modified": "2026-08-04T01:37:25.912025Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--c6eb08b6-15b4-513c-95be-9357dcb80814", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--88412cb8-67ee-5393-aeea-0bd0a69fb089", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91215Z", "modified": "2026-08-04T01:37:25.91215Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--441c3e1d-874b-5c20-8f90-a4f576240adf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff19decb-fd83-51f2-8e57-7d4395c8a5fb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.91226Z", "modified": "2026-08-04T01:37:25.91226Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--8c58dc7a-d99e-58c2-992c-0f0427c66a3d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7be20e06-e1b6-5e5f-ae25-60d3e7627c85", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912373Z", "modified": "2026-08-04T01:37:25.912373Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--6c36af25-2513-5dea-97b7-6c88dbdecc89", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f3a8e59-8da4-5d7f-b05e-e59668fca716", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912507Z", "modified": "2026-08-04T01:37:25.912507Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--396fc653-f1cf-5954-b412-d2d80e8cd84f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6111e3df-def9-5132-8e5f-6b8b5a211c3c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912699Z", "modified": "2026-08-04T01:37:25.912699Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--22b30454-aeee-5141-9b04-2e88ec06bc35", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0724b3e3-90d5-5ea0-a093-d59343e035c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912837Z", "modified": "2026-08-04T01:37:25.912837Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--fa256b38-12b1-5955-aa73-934fa95c41dd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dcffa562-08b8-5e0a-8a5c-d5c81d3897c3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.912972Z", "modified": "2026-08-04T01:37:25.912972Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--c6750e0f-6848-5055-840e-6624bb6ba197", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a57f538c-2532-521a-8e7b-f3f6928734fe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.913096Z", "modified": "2026-08-04T01:37:25.913096Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--5c0144d7-9fb5-563a-962f-2a656247fd49", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8a950b6b-1dba-514b-9c11-8bb11c4cec37", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.913219Z", "modified": "2026-08-04T01:37:25.913219Z", "relationship_type": "related-to", "source_ref": "malware--953777c1-e01d-568e-9445-216014181b50", "target_ref": "tool--04ab9a36-6c1f-5b7a-b7e4-f392a7d600c9", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--9e9a2d1e-2840-51a5-af43-b5ef11a64213", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-08-04T01:37:25.913472Z", "modified": "2026-08-04T01:37:25.913472Z", "name": "CloudSync: An Assembler's Intrusion Toolkit", "description": "Assembled 22-sample intrusion toolkit staged on a live open directory. Operator estate and the sourced commodity-stealer service are kept in SEPARATE tiers so they are never read as one infrastructure. Credentials are defanged to first-8+last-4 (disclosure hazard); the Telegram chat id 8116056430 is retained whole as the attribution artifact. Network IOCs are NOT defanged. The 22-file set is a snapshot of what was staged, not the operator's complete toolkit (one panel port, 91.92.43.221:5003, is live with no matching build in hand).", "report_types": [ "threat-report" ], "published": "2026-08-03T00:00:00Z", "object_refs": [ "ipv4-addr--48779663-8996-5cdf-8eb8-4c4db90c6ee4", "indicator--8283b415-7124-5749-baaf-6fdc09a16ecf", "ipv4-addr--07ad3d66-c1ab-56c3-a7f8-30f76dcd7a08", "indicator--27ebf16a-7afb-514f-8c0c-460fa72a4dc6", "ipv4-addr--7fcd6ffa-2566-53e1-a0d4-84bee033eb55", "indicator--cc0fd9f4-b13c-5253-bd85-adb3d6784e68", "url--f91c189c-6503-56e3-a576-c6955156fea7", "indicator--20a11a24-904c-52a1-af61-880d4ba64c2a", "domain-name--749b8ec1-53aa-5aa1-9c62-8ed803a11609", "indicator--a6801bf7-4893-5b1a-b89a-d7b5fadf91f4", "domain-name--700dfafc-eee9-59ac-b3d4-a0b357924bf9", "indicator--21158ea7-c877-53d7-ad58-e7c05f9ceb0b", "domain-name--37b1aad0-b5ba-50cf-880d-f3f12740c2c5", "indicator--893e239a-a5dd-56bc-a561-9c79952cc75b", "file--ea450fc8-05e9-5229-8573-7325634cb7b6", "file--a94df1be-e328-5b80-92b4-da5032956fab", "file--48a93381-e5ee-563b-b1b9-ae1de6414b1a", "file--39a3e0ec-082a-57f6-b9ff-c5c42ce1bebf", "file--6d11529c-18b2-5abd-89a0-87e675829da0", "file--29525a57-f106-5828-af80-74dcf9ecc197", "file--d7ad5f7c-4e60-5219-8882-85e01dd0a458", "file--e439fc4f-77ad-5730-bd71-fd0605568b4d", "file--648a840a-99ba-5007-8583-9f676e1363d3", "file--49ae7f1c-0661-5bdd-94b2-853ad198cc84", "file--e674a89f-87a6-51dc-a3aa-82d2c174d389", "file--6cd6b88f-9bf1-50f7-992f-9cb813f57718", "indicator--78b34948-9a84-548e-b370-cd602bfd3367", "indicator--3832238b-e9ff-5b1b-9c62-6315c3bd64e2", "indicator--f482c958-8d70-57c2-9dad-cd0c7c24061b", "indicator--905535be-fa82-5642-80b4-d05d43708b7e", "indicator--57ed259c-002b-5786-96ce-12fd1fb8d493", "indicator--4d5b2dde-07e9-5752-89df-4d26f63d2131", "indicator--1432aab7-b938-55b1-82d9-f5f25a0114ca", "indicator--a235c665-2aab-5d95-a724-38e6eca63144", "indicator--59ba7a73-34c5-5942-a725-fa753d9071b4", "indicator--fb98c2b6-0f68-55d1-990e-1e4241aafd43", "indicator--03ca9929-1c95-56df-88c4-5b035e89bdfd", "indicator--e68dec58-880d-5780-8266-e9143fb2e90a", "indicator--edd8bea6-b5de-5b46-acdd-0d6168e94e1f", "indicator--47fcbba0-311e-567f-8c06-bf382699acc6", "indicator--fc541cda-266d-5b2b-a4c4-e32420a905c8", "indicator--585cb40e-8e43-5777-a39f-7a421328fc07", "indicator--194afb52-30db-5d60-abef-216cc0fd9603", "indicator--68c9aa45-457a-5b9e-a410-cb586e754f93", "indicator--5b02d60e-6510-5d3d-b18b-fc609eae79e9", "indicator--e35ee702-efcc-5ec7-85a7-b4e79e865e4c", "indicator--67bfccbe-bf69-50fe-ae74-1f52ed9cc1f3", "indicator--ea7ca0d0-0270-5679-8e18-58363adea101", "indicator--f2584825-2b0f-587f-ae97-c23631841b49", "indicator--b09a55a5-afd6-52f5-9093-a460ef8b50ae", "indicator--f105f13e-d81e-5347-9b09-6f97765323c3", "indicator--90a2a481-8241-5862-bec0-0e687eca2955", "indicator--e52b8888-f173-57a1-bd34-40f54cedeebb", "indicator--0a0add0c-c85a-55ca-b499-522b5769129a", "indicator--d39d8a3d-469a-57b4-b940-8691dd49457b", "malware--953777c1-e01d-568e-9445-216014181b50", "malware--a9829532-574f-576c-a184-bc3fb651525d", "malware--135e856e-418d-5dba-99b0-6da5eb736158", "tool--4634c541-7106-53c9-b6f3-c0bdd766cdea", "tool--2fbfcdfd-577d-5687-b84d-b5a4ea4b5c6f", "tool--c6eb08b6-15b4-513c-95be-9357dcb80814", "tool--441c3e1d-874b-5c20-8f90-a4f576240adf", "tool--8c58dc7a-d99e-58c2-992c-0f0427c66a3d", "tool--6c36af25-2513-5dea-97b7-6c88dbdecc89", "tool--396fc653-f1cf-5954-b412-d2d80e8cd84f", "tool--22b30454-aeee-5141-9b04-2e88ec06bc35", "tool--fa256b38-12b1-5955-aa73-934fa95c41dd", "tool--c6750e0f-6848-5055-840e-6624bb6ba197", "tool--5c0144d7-9fb5-563a-962f-2a656247fd49", "tool--04ab9a36-6c1f-5b7a-b7e4-f392a7d600c9", "attack-pattern--5743605a-3d87-5989-8a8b-73446c9ec5d3", "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "attack-pattern--c1d4cd2d-a87a-5026-9a32-1b3f8f09459b", "attack-pattern--7373eec5-e966-5e5e-8010-488ee0ec6942", "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "attack-pattern--78cb525e-55ae-5185-8b31-d245bb9532cd", "attack-pattern--2a264b9c-3fd7-5eeb-9ade-d73008a13713", "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "attack-pattern--19b23d6f-0fe0-53c3-b371-c7532e505132", "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "attack-pattern--8c6fbe48-7b7a-543c-a547-e7de90a8db6c", "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "attack-pattern--4d78476e-e20d-514e-afd4-b91af65314cc", "attack-pattern--b41e6891-97a9-552c-8eb3-afaa1f79e9d4", "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "attack-pattern--4cbca60b-20d4-5fd7-8e70-29e9475fa89f", "attack-pattern--ba2d866b-110d-5350-8c82-dbc17d7abad3", "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "attack-pattern--519ad548-2612-50a9-b36f-4c734818a1e0", "attack-pattern--a08f8085-d76d-5961-9cc5-38087943d6db", "attack-pattern--343c48ab-a3c6-5ff7-b6e7-3dd92d069ca8", "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "attack-pattern--351c2bb8-092f-5863-b623-f9ca08b16432", "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "infrastructure--22f52dfa-fe20-5523-af01-ffdf35256f72", "relationship--f54447d6-024b-5bec-8cd8-ee7ab319ffcd", "relationship--43d99a34-c329-5dba-892a-558309947deb", "relationship--9eca5e05-1947-5415-9d6e-97d7d199273a", "relationship--807ec3ec-a640-5054-8a74-fb6bebae0a1f", "relationship--e009c63f-27f1-5c44-93e3-eea2ba9667c3", "relationship--18161b3b-f057-525e-9681-4f9b1d5aeebf", "relationship--2b9c5f89-5857-52a4-9fa1-eff3d5b530f1", "relationship--5143bf0d-e440-5664-8feb-96066deceaa9", "relationship--ca95b9a0-db1e-5f62-8979-62368b96f66f", "relationship--d2879f22-6642-52c2-91f9-766aff7753f6", "relationship--46ebeb16-fd37-5b38-9022-4da947ee2793", "relationship--0e28466f-fab0-5635-85c2-5b4a158e2208", "relationship--1db35d42-0675-57e3-9d77-7c63ede48281", "relationship--1648dd4f-699d-5af7-be83-7b9f2e1bb8d3", "relationship--ea183df8-06d8-5250-88ed-b9c8361ce210", "relationship--4aa9362f-d8b4-5ad3-9295-fdf2550b1236", "relationship--f25a3ca6-f347-5aa9-85f5-a7aa1ad89fda", "relationship--0c9bc8d7-d841-55b4-a9a5-003d61755905", "relationship--20533762-689f-51a2-ae08-46a3f6b279b0", "relationship--b13fb2b0-68d8-5f01-bda3-df3aead75065", "relationship--f2e21ee9-b0ee-5fc8-a111-13c6bb99576a", "relationship--a5b1decd-c245-55b6-846b-a8a058e9a331", "relationship--66e7a5ec-e2f8-5942-a12d-6c7eb5851600", "relationship--e71f9198-628a-5a6e-bca9-e7a78c904a16", "relationship--3422d4ae-10e6-5f7b-8e73-143b4586140c", "relationship--994c0846-c22e-5c16-870d-5494d337298c", "relationship--c4d206ca-c8a1-58a6-a40c-fa4ba595ee39", "relationship--3b585ac7-fc50-5915-91d9-f77ae39ff709", "relationship--39f4e215-4535-5df0-8f15-784c8297f83d", "relationship--ae906f6d-7ac4-55de-bec8-47be4dfdf907", "relationship--f623d0e3-494d-55bf-b996-6994451ca5e7", "relationship--7541a68a-b363-5cbc-9e2c-f5ca28355bef", "relationship--a031e736-92c8-5827-99ee-c49a75985ec5", "relationship--be1be9e9-0fe0-5379-9352-282f4969955b", "relationship--d140fa41-37fc-58b8-9135-f320784310fd", "relationship--dffe86a6-5e19-5a2d-a6fb-bc98f0120594", "relationship--b3f4a74c-4856-5cfe-b4b4-65321ed7f955", "relationship--00132be3-a02b-5965-b5a2-9dcac1257fc1", "relationship--c9c97a55-092a-5e1d-a4c2-cd2f24178be4", "relationship--a29bd003-95a4-5903-a8c6-a41975fd8569", "relationship--5b359ad9-8b6f-5ac9-907f-c22f7708755d", "relationship--87f36d6f-2e4e-52f6-8d25-fd9f33d1accf", "relationship--c7fe9e07-577e-5a8a-b99e-8d82809b17d4", "relationship--4c9e59a2-2bf0-58c4-bdfa-c53eed445cb7", "relationship--753cb6b9-a071-589f-a2f1-546e107be17a", "relationship--8ba71dcb-2634-5a01-8868-725e45951dcd", "relationship--afe21149-9f28-593f-a0ac-fab59a2f6231", "relationship--ce44b449-7234-5f9e-b4ce-e3cd9aeeef53", "relationship--82b7e4dc-03bd-5dd8-8838-525ff4eab532", "relationship--1e6078da-ee67-5f8e-9540-7b10b0e3a336", "relationship--64339d45-b190-5fb6-8c17-a78e2c156e34", "relationship--2ec63ab7-e355-5cd0-91cf-538ae37263d6", "relationship--7328b166-9f6b-50ca-b3c6-ef27412220cb", "relationship--8c1fd766-5e83-5f44-8040-ea74f25ee667", "relationship--f588f741-e065-5f11-8e46-63b57ffe9302", "relationship--51aaf5ba-d5d4-5be1-8054-cfd5d3bbfd51", "relationship--0a028250-b3f5-56a0-a4ea-8a1d3aa5bcee", "relationship--ba683a13-e744-5274-951b-877ab902e865", "relationship--da083691-937d-58e5-925c-ef213ec0bff2", "relationship--1734f846-160e-53ba-860c-cb2b4c95c5f0", "relationship--c83f881e-0308-58a5-b66e-8a5bb035aeb9", "relationship--963e4b4e-0a73-558d-aaf6-e814fdf6b49a", "relationship--d2d9a1db-8237-5a5f-b733-0e6fc05b0687", "relationship--bba67c68-3e09-5803-afca-3606d122cddf", "relationship--412c87e0-4bbe-527b-b88f-ff05a69a329d", "relationship--16a6cb9b-805e-55a6-8c96-43fb17c78ece", "relationship--7477145c-777e-5aa6-a5a8-f34d37c76dbe", "relationship--e9ba0ef8-aeb3-5e16-ac0a-f0dcc584fc2a", "relationship--04125bfb-f1b1-5114-a2c8-09713edade45", "relationship--89a61867-0570-5a60-81f2-afd1dccd1c00", "relationship--2dc0e958-2113-5f26-a6ba-721d5b2641cf", "relationship--eec361dd-ab0c-5436-b402-428bc5b6c4d6", "relationship--9850281c-7099-5d53-bdb8-a01137cd7431", "relationship--fdbdb4c2-b075-5161-9576-69befd6ef2c8", "relationship--2e41cabd-b38d-563d-9ad5-4632f85d7634", "relationship--c2c6f96e-1a59-53a2-bafc-a0426a2fb8e1", "relationship--a4e13065-57b6-5f87-9681-ba921178b9ce", "relationship--38e613c9-5142-5d33-b5a4-fa0124ef7acb", "relationship--91f57a4b-e29e-5d47-981c-c8d93187e543", "relationship--af1cd129-0e7a-540e-8b78-07697cbe34b6", "relationship--ec690657-2feb-5ba0-a339-f6820c8a44e0", "relationship--371b3682-7faf-5000-818f-826e4fc1b925", "relationship--8ce81cab-d35c-579c-bb3f-fa3ee61a0e01", "relationship--2b089cec-2208-5cc6-8860-2bca623db9a1", "relationship--c3df7500-7604-5180-a7a7-c8e0f59b5574", "relationship--decb01c3-92de-56cc-af01-fb0224fbf97d", "relationship--8260341a-8036-5687-8df3-dac3c4e1992f", "relationship--501851e0-62f2-5a42-b477-3f6966d4e6fe", "relationship--ee4a88ba-5d54-52a4-be07-6dbbb0f4ffb7", "relationship--8fb8843e-0bd6-5339-b39e-f02e5b529477", "relationship--93dd7924-b1d3-51ac-9050-242d15d88f78", "relationship--0071c6f9-0c2e-5a1b-94bd-519199514c95", "relationship--eb51f0fe-4007-5bf5-912f-725eceefe284", "relationship--50fc8c50-821d-5a3b-b943-e1ed87443d82", "relationship--8b7f43c7-d8ac-553c-b30d-3b6bf91712d6", "relationship--4ac40f6a-d065-54ec-bd9c-c480c942a511", "relationship--74d9d3dc-3e66-5c6d-b857-9d9d1f9f6faf", "relationship--74c6f9ec-16ea-5ebd-a14d-861300801b14", "relationship--59868de6-71d6-5aad-a688-3031784e4fe3", "relationship--e25ce7b5-0a00-5a0c-8b01-c8ab49ac16c8", "relationship--51cfb890-2031-5e24-9a53-7a72d8cf4262", "relationship--71703299-fc28-5c22-9649-ff96e8b986a0", "relationship--86857d24-cecc-506d-82c0-42525c8cf443", "relationship--2d6b2207-0a80-5284-b7a6-8b1183aaf2d1", "relationship--316c5425-5e53-5ce5-86df-2ec6ea355b49", "relationship--0456d4f3-b493-5586-9329-f5f4f5e5baad", "relationship--e9af68ff-8e6d-542a-a68a-566a0be8be72", "relationship--2eb66e4b-a436-5675-94b0-e5e5861b3a95", "relationship--c6ade71d-acd8-5f13-b581-b7e3f754bc84", "relationship--9e0ea4b4-ff0c-50b4-a0f0-708ad81a45e8", "relationship--b373df46-99af-5021-8cca-1380286a978b", "relationship--b5c98c0f-6ad4-51e4-8991-cea3f21a0d47", "relationship--c89fc7b7-bd45-5ab6-b949-fe2619fce2f4", "relationship--f3f746fd-4488-582b-b88b-3f23e5d273b2", "relationship--7923d176-7b99-56d9-8e98-e7e2e9c9cc02", "relationship--11a81d79-b270-5126-924f-40e79aa60aac", "relationship--1dbb061a-4126-51b7-8dde-9218f96881bb", "relationship--3efb4274-abfd-5198-a540-27f65c66992d", "relationship--2c9d1c91-8a34-5c28-bc3a-cd50ccc790d7", "relationship--238dbbc2-d9da-589b-b681-573e3d56144e", "relationship--fefb843e-6de6-5324-b98f-51ce22d1567c", "relationship--29974a04-a2a7-5e54-9f95-f793daca8d24", "relationship--25c1fbbd-54b4-573c-a04c-f9e00a92bfa2", "relationship--1f865ebb-13d6-5da2-ac00-f9c936956157", "relationship--00eeb566-42d9-5bee-821e-ef382def4fed", "relationship--1c1a7aa7-45de-54f3-ae21-ae11255c6f88", "relationship--4a4d12ed-39f8-5b15-824d-378222f8e12c", "relationship--f4abe10f-20d0-5185-b42d-75841171d92d", "relationship--71d8778f-fd90-5b98-beed-f72eacdfebae", "relationship--e4681bf2-6d45-5304-8007-e3a7af4e65f8", "relationship--24651a0f-1f73-5f7f-99e9-15669ac8be32", "relationship--137334ee-120b-5d9a-acea-6a97fe592057", "relationship--82f339f5-955c-5416-bdf6-77f6657965a2", "relationship--ecc094d9-1862-5c19-a727-a876caff53d8", "relationship--c0bb2292-a594-5e7a-8c9f-665f5b4b0dc0", "relationship--a80bf91d-1af6-53e5-948c-b3a0f4c77d14", "relationship--ba40f65c-fb28-5bf4-911a-257380b8ee16", "relationship--b9759067-aded-5315-836b-28701c2f6a38", "relationship--88412cb8-67ee-5393-aeea-0bd0a69fb089", "relationship--ff19decb-fd83-51f2-8e57-7d4395c8a5fb", "relationship--7be20e06-e1b6-5e5f-ae25-60d3e7627c85", "relationship--1f3a8e59-8da4-5d7f-b05e-e59668fca716", "relationship--6111e3df-def9-5132-8e5f-6b8b5a211c3c", "relationship--0724b3e3-90d5-5ea0-a093-d59343e035c9", "relationship--dcffa562-08b8-5e0a-8a5c-d5c81d3897c3", "relationship--a57f538c-2532-521a-8e7b-f3f6928734fe", "relationship--8a950b6b-1dba-514b-9c11-8bb11c4cec37" ], "labels": [ "Intrusion Toolkit", "RAT", "Access Broker" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/cloudsync-assembler-toolkit-91-197-98-188/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }