{ "type": "bundle", "id": "bundle--b7b52f55-ce52-49bc-8213-f416352171fb", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.479291Z", "modified": "2026-06-14T11:55:48.479291Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--c1adb7e2-fff9-5e44-a48a-d0f33cc6306b", "value": "67.215.232.25" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3877e5cf-fb53-54e7-880c-5c91e2f8a645", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.479743Z", "modified": "2026-06-14T11:55:48.479743Z", "name": "ipv4: 67.215.232.25", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '67.215.232.25']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--03bc5937-18aa-5dc4-9b6d-d104eab5c447", "value": "http://67.215.232.25:1337/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eae13405-8811-57c2-a2d1-604d21047010", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.480611Z", "modified": "2026-06-14T11:55:48.480611Z", "name": "url: http://67.215.232.25:1337/", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://67.215.232.25:1337/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--952fa149-1219-5b62-a263-57b4d01c73a5", "value": "http://67.215.232.25:8080/health" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a886d819-6220-516c-9dde-6b3d9513fd9e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.48132Z", "modified": "2026-06-14T11:55:48.48132Z", "name": "url: http://67.215.232.25:8080/health", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://67.215.232.25:8080/health']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--21b24b19-dc00-523c-8492-f50ddea4d33e", "value": "http://67.215.232.25:8080/api/report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--67638387-0cfa-533d-81ce-6bfb746fc7fe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.482227Z", "modified": "2026-06-14T11:55:48.482227Z", "name": "url: http://67.215.232.25:8080/api/report", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://67.215.232.25:8080/api/report']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--54f4d123-02a9-509f-a353-92bd51629526", "value": "http://67.215.232.25:8080/api/heartbeat" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--355cbdf6-8f2e-5a31-b8ce-cc60270d59c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.483014Z", "modified": "2026-06-14T11:55:48.483014Z", "name": "url: http://67.215.232.25:8080/api/heartbeat", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://67.215.232.25:8080/api/heartbeat']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--8a79aa55-54db-5223-a507-70fb98d3b9ce", "value": "http://67.215.232.25:5000/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2a6f0488-c4d7-55a7-8a5d-7369c77dbbe9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.483836Z", "modified": "2026-06-14T11:55:48.483836Z", "name": "url: http://67.215.232.25:5000/", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://67.215.232.25:5000/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 60 }, { "type": "file", "spec_version": "2.1", "id": "file--ddf10f38-4126-5b95-a27d-6859c49b2335", "hashes": { "SHA-256": "a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16ca4f73-efbe-5345-8008-6b510ea585e2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.485087Z", "modified": "2026-06-14T11:55:48.485087Z", "name": "sha256: a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-12T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 95 }, { "type": "file", "spec_version": "2.1", "id": "file--b64ac1d0-6615-57d8-9dcf-e80af29dd787", "hashes": { "SHA-256": "6e592a38f93f7119e4b28214ef90bd74bc602a411099454329be4a0c3b482245" } }, { "type": "file", "spec_version": "2.1", "id": "file--d80710c4-423c-574c-8264-314d5b3ef020", "hashes": { "SHA-256": "eb689aea9673cc025f91d8376da07e849519d19071609a60c193776d8eca8b54" } }, { "type": "file", "spec_version": "2.1", "id": "file--e8b3eb55-2a64-5ab7-bfc3-80ba7195121d", "hashes": { "SHA-256": "30a11ac0b6828fd1c808c46d1c5ae9a4050b48a2fa7e860d146d871bc7c9bb98" } }, { "type": "file", "spec_version": "2.1", "id": "file--c48d0c72-69d3-51c5-8d2f-0c68b51ec8f0", "hashes": { "SHA-256": "3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571" } }, { "type": "file", "spec_version": "2.1", "id": "file--ab9eeb5e-f564-586e-a339-5722f356d0dd", "hashes": { "SHA-256": "cac1bda7429c3b6320af4638b9dd367aaca3815877a1bb96b17f1ab769c9c7f6" } }, { "type": "file", "spec_version": "2.1", "id": "file--99f29585-fd5c-57ce-b967-0fbaf6538a88", "hashes": { "SHA-256": "9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28" } }, { "type": "file", "spec_version": "2.1", "id": "file--708e9fbc-fb3a-5aa9-8626-9780954afa20", "hashes": { "SHA-256": "602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7" } }, { "type": "file", "spec_version": "2.1", "id": "file--c823cb52-ddab-5978-a468-70e1b590a30e", "hashes": { "SHA-256": "8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586d" } }, { "type": "file", "spec_version": "2.1", "id": "file--1d7c16e6-52fe-5497-afe5-96268cb96d43", "hashes": { "SHA-256": "9c5d53208d324f6f14e3417fe072be9b0f29aa35299f99c30bbaf602790b7480" } }, { "type": "file", "spec_version": "2.1", "id": "file--3b200d62-3c88-528b-b3c0-8f8edaeb6377", "hashes": { "SHA-256": "a4778d50307de4ab13e48de90d72b7c5e19b4f9356a611a9faf95cfda0523c46" } }, { "type": "file", "spec_version": "2.1", "id": "file--d6487037-ea5b-5e6a-81dd-5d79522da177", "hashes": { "SHA-256": "db36351b2a948bda4eb5fb6ed40d850d70a9d149380ad6a12869c36beb9f042c" } }, { "type": "file", "spec_version": "2.1", "id": "file--8dc402ef-f6ea-5b09-a6ba-661072d42d37", "hashes": { "SHA-256": "8a48236180c30d5ba4b44faae8abf906ad9937192e8ff85136da659de111b920" } }, { "type": "file", "spec_version": "2.1", "id": "file--dbace70b-9543-5516-a437-8785a7968313", "hashes": { "SHA-256": "c13bb6f7898423ad218937be8aeb400f41db857ac350093e837a5eed06ae31dc" } }, { "type": "file", "spec_version": "2.1", "id": "file--08d936c5-9ea2-56df-b51d-f3658e36657d", "hashes": { "SHA-256": "596778a449881a64c08e6f152b8966c1b7a2c9096071662708ccb54f4b7f129c" } }, { "type": "file", "spec_version": "2.1", "id": "file--ad827f0b-9cd8-5a6b-b774-d1d2ffb04f4b", "hashes": { "imphash": "f9a28c458284584a93b14216308d31bd" } }, { "type": "file", "spec_version": "2.1", "id": "file--98013292-ae0e-5efe-82ab-c5959fd28a00", "hashes": { "imphash": "545a81240793f9ca97306fa5b3ad76df" } }, { "type": "file", "spec_version": "2.1", "id": "file--3c086315-7e19-51bb-9109-943301b00ea2", "hashes": { "imphash": "959a83047e80ab68b368fdb3f4c6e4ea" } }, { "type": "file", "spec_version": "2.1", "id": "file--5e1d1d00-10e2-5bc3-8ae5-cfb2090d298a", "hashes": { "imphash": "576d6e02a47c807b9063948ee683350c" } }, { "type": "file", "spec_version": "2.1", "id": "file--624348c9-1282-54e4-9cc3-402592f90483", "hashes": { "imphash": "567531f08180ab3963b70889578118a3" } }, { "type": "file", "spec_version": "2.1", "id": "file--fb177e24-a7c3-583e-beb0-b420361b449c", "hashes": { "imphash": "818cfde69b098e3348e8c7125e83915f" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d07b51f3-2144-5e42-9188-fc513ca5d541", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.490178Z", "modified": "2026-06-14T11:55:48.490178Z", "name": "MSSQL_CLR_Backdoor_CmdExec_Banner", "indicator_types": [ "malicious-activity" ], "pattern": "rule MSSQL_CLR_Backdoor_CmdExec_Banner {\n meta:\n description = \"Detects custom MSSQL SQL-CLR reverse-shell backdoor (cmd_exec.dll) based on operator-specific banner string combined with SQLCLR assembly markers and reverse-shell plumbing strings\"\n license = \"CC BY-NC 4.0 - https://creativecommons.org/licenses/by-nc/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\"\n date = \"2026-06-12\"\n hash1 = \"a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262\"\n family = \"MSSQL CLR Backdoor\"\n malware_type = \"Backdoor\"\n campaign = \"FlaskC2-PostEx-Toolkit-67.215.232.25\"\n id = \"4952ff03-a98c-54d3-9157-3a501e676b81\"\n strings:\n $banner = \"[*] Connected to SQL Server CLR backdoor\" ascii wide\n $sqlclr1 = \"StoredProcedures\" ascii wide\n $sqlclr2 = \"Microsoft.SqlServer.Server\" ascii wide\n $tcpcli = \"TcpClient\" ascii wide\n $cmdexec = \"ExecuteCommand\" ascii wide\n $slashc = \"cmd.exe\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 64KB and\n $banner and\n 2 of ($sqlclr1, $sqlclr2, $tcpcli, $cmdexec, $slashc)\n}", "pattern_type": "yara", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c39710ab-b86b-5f24-9825-eb6fcfd0a1f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.490529Z", "modified": "2026-06-14T11:55:48.490529Z", "name": "MSSQL_CLR_Backdoor_CmdExec_Assembly_Strings", "indicator_types": [ "malicious-activity" ], "pattern": "rule MSSQL_CLR_Backdoor_CmdExec_Assembly_Strings {\n meta:\n description = \"Detects MSSQL SQL-CLR reverse-shell assemblies using the stored-procedure-exposed cmd-execution pattern, covering cmd_exec.dll variants where the banner string may be changed\"\n license = \"CC BY-NC 4.0 - https://creativecommons.org/licenses/by-nc/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\"\n date = \"2026-06-12\"\n hash1 = \"a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262\"\n family = \"MSSQL CLR Backdoor\"\n malware_type = \"Backdoor\"\n campaign = \"FlaskC2-PostEx-Toolkit-67.215.232.25\"\n id = \"ad2ab99c-79cd-5cd1-9592-a91cd00c8334\"\n strings:\n $sqlclr1 = \"Microsoft.SqlServer.Server\" ascii wide\n $sqlclr2 = \"SqlProcedureAttribute\" ascii wide\n $method1 = \"reverse_shell\" ascii wide\n $method2 = \"cmd_exec\" ascii wide\n $method3 = \"ExecuteCommand\" ascii wide\n $tcpcli = \"TcpClient\" ascii wide\n $netstr = \"NetworkStream\" ascii wide\n $procsi = \"ProcessStartInfo\" ascii wide\n $redir = \"RedirectStandardOutput\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 256KB and\n ($sqlclr1 or $sqlclr2) and\n ($method1 or $method2 or $method3) and\n ($tcpcli or $netstr) and\n ($procsi or $redir)\n}", "pattern_type": "yara", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--538ac55d-fe46-5539-8fe5-53c8fde071ba", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.490711Z", "modified": "2026-06-14T11:55:48.490711Z", "name": "Webshell_NPCInfoList1_AES_Loader", "indicator_types": [ "malicious-activity" ], "pattern": "rule Webshell_NPCInfoList1_AES_Loader {\n meta:\n description = \"Detects NPCInfoList1.aspx Godzilla-style AES .NET loader webshell based on hardcoded AES-128 key=IV value ca63457538b9b1e0 used for both key and initialization vector\"\n license = \"CC BY-NC 4.0 - https://creativecommons.org/licenses/by-nc/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\"\n date = \"2026-06-12\"\n hash1 = \"eb689aea9673cc025f91d8376da07e849519d19071609a60c193776d8eca8b54\"\n family = \"Godzilla-style .NET loader webshell\"\n malware_type = \"Webshell\"\n campaign = \"FlaskC2-PostEx-Toolkit-67.215.232.25\"\n id = \"c8c8d323-6db6-565a-a13a-0fd9e927c655\"\n strings:\n $aeskey = \"ca63457538b9b1e0\" ascii wide\n $asmload = \"Assembly.Load\" ascii wide\n $createi = \"CreateInstance\" ascii wide\n $aescbc = \"RijndaelManaged\" ascii wide\n condition:\n filesize < 32KB and\n $aeskey and\n ($asmload or $createi or $aescbc)\n}", "pattern_type": "yara", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dcab50b8-aada-5814-a04b-83ef5cd256c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.490929Z", "modified": "2026-06-14T11:55:48.490929Z", "name": "Webshell_Ghost_Aatrox_ASP", "indicator_types": [ "malicious-activity" ], "pattern": "rule Webshell_Ghost_Aatrox_ASP {\n meta:\n description = \"Detects Ghost small-group (Ghost xiao-zu) ASP webshell variant configured with Aatrox password and eval gadget, as staged in the FlaskC2-PostEx-Toolkit-67.215.232.25 campaign\"\n license = \"CC BY-NC 4.0 - https://creativecommons.org/licenses/by-nc/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\"\n date = \"2026-06-12\"\n hash1 = \"30a11ac0b6828fd1c808c46d1c5ae9a4050b48a2fa7e860d146d871bc7c9bb98\"\n family = \"Ghost ASP Webshell\"\n malware_type = \"Webshell\"\n campaign = \"FlaskC2-PostEx-Toolkit-67.215.232.25\"\n id = \"33fc80d4-77b7-5790-8ecf-85379a0ddcbb\"\n strings:\n $ghost = \"Ghost\" ascii wide nocase\n $eval1 = \"Execute Session(\\\"Aatrox\\\")\" ascii wide\n $eval2 = \"UserPass=\\\"Aatrox\\\"\" ascii wide\n $wshhell = \"WScript.Shell\" ascii wide\n $fso = \"Scripting.FileSystemObject\" ascii wide\n condition:\n filesize < 200KB and\n ($eval1 or $eval2) and\n ($ghost or $wshhell or $fso)\n}", "pattern_type": "yara", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f3439843-180a-5c92-8902-025b8a45129b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.491156Z", "modified": "2026-06-14T11:55:48.491156Z", "name": "MSSQL CLR Backdoor Execution via sqlservr.exe Child cmd.exe", "indicator_types": [ "malicious-activity" ], "pattern": "title: MSSQL CLR Backdoor Execution via sqlservr.exe Child cmd.exe\nid: 124c3140-63a5-4f3c-9700-c3893edd971b\nstatus: test\ndescription: >-\n Detects cmd.exe spawned as a child of sqlservr.exe, indicating execution of a\n SQL Server CLR stored procedure that runs shell commands. This is the primary\n behavioral signature of the cmd_exec.dll MSSQL CLR reverse-shell backdoor,\n which evades generic sandboxes and most AV engines.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://github.com/evi1ox/MSSQL_BackDoor\n - https://attack.mitre.org/techniques/T1505/001/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.persistence\n - attack.t1505.001\n - attack.execution\n - attack.t1059.003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\sqlservr.exe'\n Image|endswith: '\\cmd.exe'\n condition: selection\nfalsepositives:\n - Legitimate administrative use of xp_cmdshell \u2014 baseline and exclude authorized instances\n - SQL Server maintenance jobs that intentionally invoke cmd.exe via CLR or job steps\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c6241708-06a2-54cd-9b31-97a172dd1fdc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.491299Z", "modified": "2026-06-14T11:55:48.491299Z", "name": "MSSQL sqlservr.exe Initiating Outbound TCP Connection to External Host", "indicator_types": [ "malicious-activity" ], "pattern": "title: MSSQL sqlservr.exe Initiating Outbound TCP Connection to External Host\nid: d04749cf-8423-4bbb-9fdc-cc5035787772\nstatus: test\ndescription: >-\n Detects SQL Server process (sqlservr.exe) initiating outbound TCP connections\n to external hosts. In the FlaskC2-PostEx-Toolkit campaign, cmd_exec.dll opens\n a raw reverse-TCP shell from within sqlservr.exe to operator-supplied IP and\n port parameters. Legitimate outbound connections from sqlservr.exe should be\n baselined and filtered.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://attack.mitre.org/techniques/T1505/001/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.persistence\n - attack.t1505.001\n - attack.command-and-control\n - attack.t1095\nlogsource:\n category: network_connection\n product: windows\ndetection:\n selection:\n Image|endswith: '\\sqlservr.exe'\n Initiated: 'true'\n filter_loopback:\n DestinationIp|startswith:\n - '127.'\n - '::1'\n - '10.'\n - '172.16.'\n - '172.17.'\n - '172.18.'\n - '172.19.'\n - '172.20.'\n - '172.21.'\n - '172.22.'\n - '172.23.'\n - '172.24.'\n - '172.25.'\n - '172.26.'\n - '172.27.'\n - '172.28.'\n - '172.29.'\n - '172.30.'\n - '172.31.'\n - '192.168.'\n condition: selection and not filter_loopback\nfalsepositives:\n - SQL Server linked servers pointing to external databases\n - Database Mail (SMTP outbound) \u2014 filter by port 25/587\n - SQL Server replication to external publishers \u2014 baseline expected destination IPs\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7457c594-cb79-5bdd-b42a-5864f0fd905d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.491445Z", "modified": "2026-06-14T11:55:48.491445Z", "name": "MSSQL CLR Backdoor Installation via CREATE ASSEMBLY and Reverse Shell Procedure", "indicator_types": [ "malicious-activity" ], "pattern": "title: MSSQL CLR Backdoor Installation via CREATE ASSEMBLY and Reverse Shell Procedure\nid: 68e96847-afed-4fbd-843f-952e22e89f97\nstatus: test\ndescription: >-\n Detects SQL Server CLR backdoor installation sequence: enabling CLR execution,\n creating an assembly from binary, and registering a stored procedure via\n EXTERNAL NAME. The procedure name reverse_shell in EXTERNAL NAME is a direct\n indicator of cmd_exec.dll installation. Even without the procedure name, this\n sequence in production is high-risk.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://www.netspi.com/blog/technical/network-penetration-testing/attacking-sql-server-clr-assemblies/\n - https://attack.mitre.org/techniques/T1505/001/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.persistence\n - attack.t1505.001\nlogsource:\n category: application\n product: sql_server\ndetection:\n selection_clr:\n EventID: 15457\n Message|contains: \"clr enabled\"\n selection_assembly:\n Message|contains:\n - 'CREATE ASSEMBLY'\n - 'EXTERNAL NAME'\n - 'reverse_shell'\n condition: selection_clr or selection_assembly\nfalsepositives:\n - Authorized .NET CLR assembly deployment by DBAs \u2014 correlate with change management tickets\n - Development environments where CLR assemblies are used legitimately\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6fe164cd-cb34-5587-b580-c117d19895aa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49159Z", "modified": "2026-06-14T11:55:48.49159Z", "name": "IIS Webshell Execution via w3wp.exe Spawning Shell Process", "indicator_types": [ "malicious-activity" ], "pattern": "title: IIS Webshell Execution via w3wp.exe Spawning Shell Process\nid: bb2d9a6a-be5b-47e2-9902-ebbdc4831aa6\nstatus: test\ndescription: >-\n Detects IIS worker process (w3wp.exe) spawning cmd.exe or wscript.exe, which\n indicates webshell-based command execution. In the FlaskC2-PostEx-Toolkit\n campaign, both miss.asp (Ghost xiao-zu ASP webshell via WScript.Shell) and\n NPCInfoList1.aspx (Godzilla-style .NET loader) run under w3wp.exe and can\n spawn shell processes when executing operator commands.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://attack.mitre.org/techniques/T1505/003/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.persistence\n - attack.t1505.003\n - attack.execution\n - attack.t1059.003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\w3wp.exe'\n Image|endswith:\n - '\\cmd.exe'\n - '\\wscript.exe'\n - '\\cscript.exe'\n - '\\powershell.exe'\n condition: selection\nfalsepositives:\n - Legacy web applications that intentionally invoke shell processes \u2014 baseline expected patterns\n - Authorized IIS management scripts running under the application pool identity\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--faf535a2-72a7-5b71-ae18-4c445b091c33", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.491721Z", "modified": "2026-06-14T11:55:48.491721Z", "name": "Ghost Webshell Aatrox Eval Gadget Parameter in IIS Request", "indicator_types": [ "malicious-activity" ], "pattern": "title: Ghost Webshell Aatrox Eval Gadget Parameter in IIS Request\nid: f2509a7c-9505-4b23-a2b4-b7619999f327\nstatus: test\ndescription: >-\n Detects the Aatrox eval gadget parameter in IIS web requests, indicating\n interaction with the Ghost xiao-zu ASP webshell (miss.asp) as staged in the\n FlaskC2-PostEx-Toolkit campaign. The webshell stores and executes arbitrary\n VBScript via Execute Session(\"Aatrox\") when the Aatrox parameter is present.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://attack.mitre.org/techniques/T1505/003/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.persistence\n - attack.t1505.003\n - attack.defense-evasion\n - attack.t1027.010\nlogsource:\n category: webserver\n product: iis\ndetection:\n selection:\n cs-uri-stem|endswith: '.asp'\n cs-uri-query|contains: 'Aatrox'\n selection_body:\n cs-uri-stem|endswith: '.asp'\n cs-method: 'POST'\n condition: selection or selection_body\nfalsepositives:\n - Legitimate web applications with parameters containing the string Aatrox \u2014 extremely unlikely in corporate IIS environments\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--958a1475-95fb-5ee2-b589-882c7165b012", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.491851Z", "modified": "2026-06-14T11:55:48.491851Z", "name": "FlaskC2-PostEx Native Tool Execution by Imphash", "indicator_types": [ "malicious-activity" ], "pattern": "title: FlaskC2-PostEx Native Tool Execution by Imphash\nid: 617292af-db3a-48e3-b18f-69ed31aef19e\nstatus: test\ndescription: >-\n Detects execution of native post-exploitation tools from the\n FlaskC2-PostEx-Toolkit-67.215.232.25 campaign based on import-table hashes\n (imphash). The covered tools are JuicyPotato (f9a28c45), PrintSpoofer\n (545a8124), RoguePotato (959a8304), RogueOxidResolver (576d6e02), Netcat\n nc64 (567531f0), and CVE-2026-20817 PoC (818cfde6). Imphash-based detection\n survives file renaming.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://attack.mitre.org/techniques/T1134/001/\n - https://attack.mitre.org/techniques/T1068/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.privilege-escalation\n - attack.t1134.001\n - attack.t1068\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Imphash|contains:\n - 'f9a28c458284584a93b14216308d31bd'\n - '545a81240793f9ca97306fa5b3ad76df'\n - '959a83047e80ab68b368fdb3f4c6e4ea'\n - '576d6e02a47c807b9063948ee683350c'\n - '567531f08180ab3963b70889578118a3'\n - '818cfde69b098e3348e8c7125e83915f'\n condition: selection\nfalsepositives:\n - None expected \u2014 these imphashes correspond to specific security tool builds with no legitimate enterprise use\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e3da29db-1e46-5fe2-a522-8694ce61c7d2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49198Z", "modified": "2026-06-14T11:55:48.49198Z", "name": "CVE-2026-20817 WER LPE PoC Token Inspection of WerFault.exe", "indicator_types": [ "malicious-activity" ], "pattern": "title: CVE-2026-20817 WER LPE PoC Token Inspection of WerFault.exe\nid: ff8ee6c2-d705-4ebf-98bd-6ead3d775ae0\nstatus: test\ndescription: >-\n Detects process access events targeting WerFault.exe with token query rights,\n consistent with the CVE-2026-20817 WER ALPC local-privilege-escalation PoC\n present in the FlaskC2-PostEx-Toolkit campaign. The PoC enumerates processes\n looking for WerFault.exe and inspects its token privileges. This rule is\n relevant only on hosts missing the January 2026 Windows cumulative update;\n the sample analyzed is non-weaponized and does not achieve elevation.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/\n - https://github.com/oxfemale/CVE-2026-20817\n - https://itm4n.github.io/cve-2026-20817-wersvc-eop/\n - https://attack.mitre.org/techniques/T1068/\nauthor: The Hunters Ledger\ndate: 2026-06-12\ntags:\n - attack.privilege-escalation\n - attack.t1068\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n TargetImage|endswith: '\\WerFault.exe'\n GrantedAccess|contains: '0x20'\n filter_system:\n SourceImage|endswith:\n - '\\WerMgr.exe'\n - '\\svchost.exe'\n - '\\MsMpEng.exe'\n condition: selection and not filter_system\nfalsepositives:\n - EDR and security tooling that monitors WerFault.exe token state\n - Crash reporting integrations that inspect WerFault process state\n - Only deploy on unpatched hosts (pre-January 2026 Windows cumulative update)\nlevel: low", "pattern_type": "sigma", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--54123630-9eb0-5171-96d5-83857061f599", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492108Z", "modified": "2026-06-14T11:55:48.492108Z", "name": "THL FlaskC2-PostEx C2 Health Endpoint Response - Bespoke Flask C2 Active", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> 67.215.232.25 any (\n msg:\"THL FlaskC2-PostEx C2 Health Endpoint Response - Bespoke Flask C2 Active\";\n flow:established,to_client;\n file_data;\n content:\"active_servers\"; nocase;\n content:\"pending_commands\"; nocase; distance:0;\n content:\"completed_commands\"; nocase; distance:0;\n content:\"status\"; nocase; distance:0;\n content:\"timestamp\"; nocase; distance:0;\n classtype:trojan-activity;\n reference:url,the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/;\n sid:9001001; rev:1;\n)", "pattern_type": "suricata", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--78df0b7a-723e-5bd4-a727-20e7517ea4ba", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492234Z", "modified": "2026-06-14T11:55:48.492234Z", "name": "THL FlaskC2-PostEx C2 Beacon POST to /api/report or /api/heartbeat", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> any any (\n msg:\"THL FlaskC2-PostEx C2 Beacon POST to /api/report or /api/heartbeat\";\n flow:established,to_server;\n http.method; content:\"POST\";\n http.uri; content:\"/api/report\"; nocase;\n classtype:trojan-activity;\n reference:url,the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/;\n sid:9001002; rev:1;\n)\n\nalert http $HOME_NET any -> any any (\n msg:\"THL FlaskC2-PostEx C2 Beacon POST to /api/heartbeat\";\n flow:established,to_server;\n http.method; content:\"POST\";\n http.uri; content:\"/api/heartbeat\"; nocase;\n classtype:trojan-activity;\n reference:url,the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/;\n sid:9001003; rev:1;\n)", "pattern_type": "suricata", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6cb61dd1-7866-5756-83e2-28d035e64cfe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492362Z", "modified": "2026-06-14T11:55:48.492362Z", "name": "THL FlaskC2-PostEx C2 Known Staging Host 67.215.232.25", "indicator_types": [ "malicious-activity" ], "pattern": "alert ip $HOME_NET any -> 67.215.232.25 any (\n msg:\"THL FlaskC2-PostEx C2 Known Staging Host 67.215.232.25\";\n classtype:trojan-activity;\n reference:url,the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/;\n threshold:type limit, track by_src, seconds 300, count 1;\n sid:9001004; rev:1;\n)", "pattern_type": "suricata", "valid_from": "2026-06-12T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492505Z", "modified": "2026-06-14T11:55:48.492505Z", "name": "MSSQL SQL-CLR reverse-shell backdoor (bespoke build of a known technique)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492678Z", "modified": "2026-06-14T11:55:48.492678Z", "name": "SeImpersonate Potato suite (EfsPotato, GodPotato, JuicyPotato, PrintSpoofer, RoguePotato, SweetPotato)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492805Z", "modified": "2026-06-14T11:55:48.492805Z", "name": "Rubeus (GhostPack Kerberos abuse)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.492939Z", "modified": "2026-06-14T11:55:48.492939Z", "name": "SharpSuccessor (BadSuccessor/dMSA AD privesc)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49306Z", "modified": "2026-06-14T11:55:48.49306Z", "name": "Godzilla-style AES .NET loader webshell (NPCInfoList1.aspx)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.493194Z", "modified": "2026-06-14T11:55:48.493194Z", "name": "Ghost\u5c0f\u7ec4 ASP webshell (miss.asp)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49336Z", "modified": "2026-06-14T11:55:48.49336Z", "name": "Netcat (nc64)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.493527Z", "modified": "2026-06-14T11:55:48.493527Z", "name": "CVE-2026-20817 WER ALPC LPE PoC (non-weaponized demo)", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.493699Z", "modified": "2026-06-14T11:55:48.493699Z", "name": "cmd_exece.dll", "description": "BESPOKE MSSQL SQL-CLR reverse-shell backdoor; [SqlProcedure] reverse_shell(ip,port) -> cmd.exe /c. Specific operator build (compile 2026-03-21). VT 32 malicious; Zenbox harmless 98% (sandbox-resistant), Microsoft+Kaspersky clean.", "malware_types": [ "backdoor" ], "is_family": false, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--2eaef1c0-1b00-58e1-a7df-761e3586797d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.493896Z", "modified": "2026-06-14T11:55:48.493896Z", "name": "Non-weaponized demonstration PoC for the WER ALPC LPE", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--d4d00aae-6a88-5829-946b-e0c9afcc9d11", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494048Z", "modified": "2026-06-14T11:55:48.494048Z", "name": "AES in-memory .NET assembly loader webshell", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--9056c14c-e267-5f9c-9c20-c1c706e590e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494183Z", "modified": "2026-06-14T11:55:48.494183Z", "name": "Commodity Ghost\u5c0f\u7ec4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--69c99921-0cd1-5d9c-84fb-a7f39dd061e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494294Z", "modified": "2026-06-14T11:55:48.494294Z", "name": "Netcat", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--d3f7b47d-d1a7-5ce5-a8cf-3d512c311e0c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494405Z", "modified": "2026-06-14T11:55:48.494405Z", "name": "EfsPotato", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a1f40bc4-160a-53a0-b3e7-335de782ebd3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494509Z", "modified": "2026-06-14T11:55:48.494509Z", "name": "GodPotato", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--63ce5b8f-adb3-5b41-bfbe-e07f9e40c609", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494631Z", "modified": "2026-06-14T11:55:48.494631Z", "name": "JuicyPotato", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f381d190-a6c7-55a6-b330-a67caf12e542", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494736Z", "modified": "2026-06-14T11:55:48.494736Z", "name": "PrintSpoofer64", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--7011d2a2-4da3-50db-99dc-a12ffec1cba1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.494847Z", "modified": "2026-06-14T11:55:48.494847Z", "name": "RoguePotato OXID-resolver helper", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--b3b12109-4f2f-54c7-87f7-b3398ea698b0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49496Z", "modified": "2026-06-14T11:55:48.49496Z", "name": "RoguePotato", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--830ad337-5c1b-5f17-ba43-9727d02f38f8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495078Z", "modified": "2026-06-14T11:55:48.495078Z", "name": "Rubeus", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--e45a98ad-052a-560d-9d30-9558293a128e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495211Z", "modified": "2026-06-14T11:55:48.495211Z", "name": "SharpSuccessor", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--cd501157-8cc7-5e45-9923-15b907e91a5f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495326Z", "modified": "2026-06-14T11:55:48.495326Z", "name": "SweetPotato", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--696d88bf-8cb9-5020-b8d3-a89606343b2d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495449Z", "modified": "2026-06-14T11:55:48.495449Z", "name": "NtApiDotNet public library", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495565Z", "modified": "2026-06-14T11:55:48.495565Z", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190", "external_id": "T1190" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495751Z", "modified": "2026-06-14T11:55:48.495751Z", "name": "SQL Stored Procedures", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1505/001", "external_id": "T1505.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.495928Z", "modified": "2026-06-14T11:55:48.495928Z", "name": "Web Shell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1505/003", "external_id": "T1505.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49609Z", "modified": "2026-06-14T11:55:48.49609Z", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/003", "external_id": "T1059.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.496233Z", "modified": "2026-06-14T11:55:48.496233Z", "name": "Visual Basic", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/005", "external_id": "T1059.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.496373Z", "modified": "2026-06-14T11:55:48.496373Z", "name": "Command Obfuscation", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1027/010", "external_id": "T1027.010" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49705Z", "modified": "2026-06-14T11:55:48.49705Z", "name": "Reflective Code Loading", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1620", "external_id": "T1620" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.497209Z", "modified": "2026-06-14T11:55:48.497209Z", "name": "Deobfuscate/Decode Files or Information", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1140", "external_id": "T1140" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.497349Z", "modified": "2026-06-14T11:55:48.497349Z", "name": "Token Impersonation/Theft", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1134/001", "external_id": "T1134.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.497485Z", "modified": "2026-06-14T11:55:48.497485Z", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1068", "external_id": "T1068" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.497622Z", "modified": "2026-06-14T11:55:48.497622Z", "name": "Kerberoasting", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1558/003", "external_id": "T1558.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.497759Z", "modified": "2026-06-14T11:55:48.497759Z", "name": "Golden Ticket", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1558/001", "external_id": "T1558.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.49791Z", "modified": "2026-06-14T11:55:48.49791Z", "name": "Pass the Ticket", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1550/003", "external_id": "T1550.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498103Z", "modified": "2026-06-14T11:55:48.498103Z", "name": "Domain Accounts", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1078/002", "external_id": "T1078.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498248Z", "modified": "2026-06-14T11:55:48.498248Z", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1057", "external_id": "T1057" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498395Z", "modified": "2026-06-14T11:55:48.498395Z", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498552Z", "modified": "2026-06-14T11:55:48.498552Z", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1071/001", "external_id": "T1071.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498721Z", "modified": "2026-06-14T11:55:48.498721Z", "name": "Non-Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1095", "external_id": "T1095" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498859Z", "modified": "2026-06-14T11:55:48.498859Z", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1105", "external_id": "T1105" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.498995Z", "modified": "2026-06-14T11:55:48.498995Z", "name": "Remote Services", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1021", "external_id": "T1021" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.499141Z", "modified": "2026-06-14T11:55:48.499141Z", "name": "flaskc2-postex-toolkit-67-215-232-25 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.499576Z", "modified": "2026-06-14T11:55:48.499576Z", "name": "CVE-2026-20817", "external_references": [ { "source_name": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20817", "external_id": "CVE-2026-20817" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7fc9d260-d1a0-51ec-8c85-9ef69a04b177", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500057Z", "modified": "2026-06-14T11:55:48.500057Z", "relationship_type": "indicates", "source_ref": "indicator--3877e5cf-fb53-54e7-880c-5c91e2f8a645", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--372b7e14-1bae-55d8-96fa-e04ad9836e76", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500191Z", "modified": "2026-06-14T11:55:48.500191Z", "relationship_type": "indicates", "source_ref": "indicator--eae13405-8811-57c2-a2d1-604d21047010", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5931caa-fa81-5034-9437-64816949f223", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500329Z", "modified": "2026-06-14T11:55:48.500329Z", "relationship_type": "indicates", "source_ref": "indicator--a886d819-6220-516c-9dde-6b3d9513fd9e", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4fa46841-0768-520d-9875-9ec02d9c20c1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500466Z", "modified": "2026-06-14T11:55:48.500466Z", "relationship_type": "indicates", "source_ref": "indicator--67638387-0cfa-533d-81ce-6bfb746fc7fe", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae14c1f3-a69a-5a54-acbf-d1581573127d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500678Z", "modified": "2026-06-14T11:55:48.500678Z", "relationship_type": "indicates", "source_ref": "indicator--355cbdf6-8f2e-5a31-b8ce-cc60270d59c9", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--957159be-d8d3-552f-a701-03af1075c79a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500823Z", "modified": "2026-06-14T11:55:48.500823Z", "relationship_type": "indicates", "source_ref": "indicator--2a6f0488-c4d7-55a7-8a5d-7369c77dbbe9", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b27ceae-d2c2-5cf4-8e52-36428e5bc058", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.500956Z", "modified": "2026-06-14T11:55:48.500956Z", "relationship_type": "indicates", "source_ref": "indicator--16ca4f73-efbe-5345-8008-6b510ea585e2", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24e44a64-97b3-566a-a028-2a73f4d921bc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.501099Z", "modified": "2026-06-14T11:55:48.501099Z", "relationship_type": "indicates", "source_ref": "indicator--d07b51f3-2144-5e42-9188-fc513ca5d541", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b3d7cdf-c824-564d-afa3-60acd7b40214", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.501557Z", "modified": "2026-06-14T11:55:48.501557Z", "relationship_type": "indicates", "source_ref": "indicator--c39710ab-b86b-5f24-9825-eb6fcfd0a1f0", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce2cdedb-8c50-5b2b-bc0f-d7daf92c52f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.501802Z", "modified": "2026-06-14T11:55:48.501802Z", "relationship_type": "indicates", "source_ref": "indicator--538ac55d-fe46-5539-8fe5-53c8fde071ba", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af05ef00-4dde-5ab8-bfc9-3a6fdf0972dc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.501984Z", "modified": "2026-06-14T11:55:48.501984Z", "relationship_type": "indicates", "source_ref": "indicator--dcab50b8-aada-5814-a04b-83ef5cd256c9", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd47b930-7d22-51ed-becf-eb04cb4cabc6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502185Z", "modified": "2026-06-14T11:55:48.502185Z", "relationship_type": "indicates", "source_ref": "indicator--f3439843-180a-5c92-8902-025b8a45129b", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05633a2e-a12e-5986-888d-51b92935ee22", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502376Z", "modified": "2026-06-14T11:55:48.502376Z", "relationship_type": "indicates", "source_ref": "indicator--c6241708-06a2-54cd-9b31-97a172dd1fdc", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60b40f4c-366e-51c6-b152-5bdf0e025d5f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502534Z", "modified": "2026-06-14T11:55:48.502534Z", "relationship_type": "indicates", "source_ref": "indicator--7457c594-cb79-5bdd-b42a-5864f0fd905d", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72503b72-d067-58bc-865d-871d0082d939", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502667Z", "modified": "2026-06-14T11:55:48.502667Z", "relationship_type": "indicates", "source_ref": "indicator--6fe164cd-cb34-5587-b580-c117d19895aa", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--628d0fc7-8a63-5142-b15a-e5d82e550aeb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502823Z", "modified": "2026-06-14T11:55:48.502823Z", "relationship_type": "indicates", "source_ref": "indicator--faf535a2-72a7-5b71-ae18-4c445b091c33", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c25399e8-f6d9-5c03-84de-b04199d1fc4d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.502936Z", "modified": "2026-06-14T11:55:48.502936Z", "relationship_type": "indicates", "source_ref": "indicator--958a1475-95fb-5ee2-b589-882c7165b012", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e5e9628-2d8b-55c1-8d55-393a3a3a4796", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.503058Z", "modified": "2026-06-14T11:55:48.503058Z", "relationship_type": "indicates", "source_ref": "indicator--e3da29db-1e46-5fe2-a522-8694ce61c7d2", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f1e56d32-e633-5a00-8b83-087a8a3951fd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50321Z", "modified": "2026-06-14T11:55:48.50321Z", "relationship_type": "indicates", "source_ref": "indicator--54123630-9eb0-5171-96d5-83857061f599", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a301e198-adaa-59e9-b84b-cd7177aa4c71", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.503356Z", "modified": "2026-06-14T11:55:48.503356Z", "relationship_type": "indicates", "source_ref": "indicator--78df0b7a-723e-5bd4-a727-20e7517ea4ba", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb150823-6f86-5042-beac-ad3742844ab9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.503476Z", "modified": "2026-06-14T11:55:48.503476Z", "relationship_type": "indicates", "source_ref": "indicator--6cb61dd1-7866-5756-83e2-28d035e64cfe", "target_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--902d6d0f-efe8-5072-8d11-14198f077f0f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.503595Z", "modified": "2026-06-14T11:55:48.503595Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6570a235-a393-58b1-a6b1-cfb446192bd2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.503715Z", "modified": "2026-06-14T11:55:48.503715Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3981e072-cf79-54d5-8168-aa97fd965393", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504129Z", "modified": "2026-06-14T11:55:48.504129Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2bb20083-7df2-5021-9067-deca8663d979", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504282Z", "modified": "2026-06-14T11:55:48.504282Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--97779d0f-069f-5b87-ab37-5b5b53602e67", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504404Z", "modified": "2026-06-14T11:55:48.504404Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--569d0c61-e837-5c5e-ae7c-15ba16c37f3b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504533Z", "modified": "2026-06-14T11:55:48.504533Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a6eebd3-199b-5c6e-847f-638190ebc1eb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504644Z", "modified": "2026-06-14T11:55:48.504644Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e404a982-7927-5817-a8f8-972c0d999af7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504769Z", "modified": "2026-06-14T11:55:48.504769Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--408a4376-79cb-51ac-84ba-290492b68ed7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.504886Z", "modified": "2026-06-14T11:55:48.504886Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a66a80c8-68e2-597a-9701-2f5c43261e47", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505Z", "modified": "2026-06-14T11:55:48.505Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9456138e-dea0-5a2f-9d45-fc5c38838a97", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505122Z", "modified": "2026-06-14T11:55:48.505122Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e101d35-1d1e-5dcb-93b1-9391d4704a66", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505282Z", "modified": "2026-06-14T11:55:48.505282Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af5886b3-42bc-51af-ae95-d38f80f9ac4c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505425Z", "modified": "2026-06-14T11:55:48.505425Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77b4000d-3dd0-5f6c-9395-fde4834fe665", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505559Z", "modified": "2026-06-14T11:55:48.505559Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b87bc9d-4b17-5e63-9342-8fe85de3fbc2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505676Z", "modified": "2026-06-14T11:55:48.505676Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d68b015a-d401-5fbc-a2ef-70d998fbe5f2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505841Z", "modified": "2026-06-14T11:55:48.505841Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df05dbac-2576-5a3b-880d-125bc482b76b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.505962Z", "modified": "2026-06-14T11:55:48.505962Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--180ccbb9-f8c9-5257-bf7f-6b82ef17ba71", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506082Z", "modified": "2026-06-14T11:55:48.506082Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4328b84-747a-59f8-81e8-3560efe8e3ec", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506204Z", "modified": "2026-06-14T11:55:48.506204Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--57e01fa2-628d-5f61-8fb0-94576be9b5f7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506326Z", "modified": "2026-06-14T11:55:48.506326Z", "relationship_type": "uses", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a12adda-9ac6-5b97-904f-eaaba652c120", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506473Z", "modified": "2026-06-14T11:55:48.506473Z", "relationship_type": "communicates-with", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ff5be14-d12c-5c4d-a8d7-3361e4115189", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506641Z", "modified": "2026-06-14T11:55:48.506641Z", "relationship_type": "exploits", "source_ref": "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ef4d9d8-1209-531e-ab7c-ba1c84a4c136", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506765Z", "modified": "2026-06-14T11:55:48.506765Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e78151af-9562-52b5-840b-458dd2559377", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.506882Z", "modified": "2026-06-14T11:55:48.506882Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49779b76-a33c-5339-b0c2-2186b43403d7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507038Z", "modified": "2026-06-14T11:55:48.507038Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f443c2f5-9747-57ff-83ec-e7431b1d552a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507157Z", "modified": "2026-06-14T11:55:48.507157Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b61d5c4-3f0c-5966-b314-35660757b689", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507267Z", "modified": "2026-06-14T11:55:48.507267Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76b13899-0cb5-5902-aa60-b6bc6b8e9596", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50739Z", "modified": "2026-06-14T11:55:48.50739Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3d7881a6-5285-557a-9a4b-436dd5aae5b9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507519Z", "modified": "2026-06-14T11:55:48.507519Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6dbb443f-d342-5e86-8417-ebf7e6627477", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507629Z", "modified": "2026-06-14T11:55:48.507629Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b14454d1-e6bf-526c-a5a6-0a7eff7b52b0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507741Z", "modified": "2026-06-14T11:55:48.507741Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5095c80a-ad55-58b3-aeda-2fee590376f4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.507856Z", "modified": "2026-06-14T11:55:48.507856Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6252edf-c7f8-599f-aa47-bc2fb62dbd46", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50797Z", "modified": "2026-06-14T11:55:48.50797Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70b86331-09bd-5ee7-a510-ef944551f91b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508083Z", "modified": "2026-06-14T11:55:48.508083Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c61da364-ef22-5b5f-8b3e-9a5ad866044b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508193Z", "modified": "2026-06-14T11:55:48.508193Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4fee7df4-3503-5b01-9121-d31944544f8e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508305Z", "modified": "2026-06-14T11:55:48.508305Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eec16073-c1fd-5aaf-aebb-16abf3a76be1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508415Z", "modified": "2026-06-14T11:55:48.508415Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c93a8b5-266a-5ee5-960e-78a566936d1c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508524Z", "modified": "2026-06-14T11:55:48.508524Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f1b4e46c-d552-5882-9325-3a1ef0f1dcdf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508632Z", "modified": "2026-06-14T11:55:48.508632Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9945c8b6-3ef1-5f91-9adb-fc4db379f294", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50874Z", "modified": "2026-06-14T11:55:48.50874Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7311bce1-93c9-57a8-8025-f52318c30c1c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50885Z", "modified": "2026-06-14T11:55:48.50885Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d29ceff-f454-5867-b7f8-9f8c53b9ea5b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.508966Z", "modified": "2026-06-14T11:55:48.508966Z", "relationship_type": "uses", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c624f2f-8b38-5d15-92c0-826260489871", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509076Z", "modified": "2026-06-14T11:55:48.509076Z", "relationship_type": "communicates-with", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38bed784-8124-58db-a1ad-4e3ef6af03db", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509191Z", "modified": "2026-06-14T11:55:48.509191Z", "relationship_type": "exploits", "source_ref": "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--954db5df-2e32-54fd-80aa-fde8647451c0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509331Z", "modified": "2026-06-14T11:55:48.509331Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ad5c378-879d-5212-9bcb-3ebf5b1451dc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509459Z", "modified": "2026-06-14T11:55:48.509459Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7bd06925-7480-5a0d-841d-8d9abd988ba8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509613Z", "modified": "2026-06-14T11:55:48.509613Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--761d2673-8f15-5846-a84a-49b864d3a16d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.509762Z", "modified": "2026-06-14T11:55:48.509762Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5058a1b8-df9e-58c3-a5c5-88e99cc10534", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.50989Z", "modified": "2026-06-14T11:55:48.50989Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5fb9bb68-e3c4-5336-9896-94ffb31d140b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510003Z", "modified": "2026-06-14T11:55:48.510003Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93932a68-7501-55cf-b912-5a16a015aeda", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510115Z", "modified": "2026-06-14T11:55:48.510115Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea5a9b34-f43f-5a59-a05f-40612ca683f7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510225Z", "modified": "2026-06-14T11:55:48.510225Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--832a5d78-0c74-57ed-a7b1-4244c2495dec", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510335Z", "modified": "2026-06-14T11:55:48.510335Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b077141e-4e81-5c6d-bff3-f7ea8842bd49", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510445Z", "modified": "2026-06-14T11:55:48.510445Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5117c00b-0f1f-50e5-860e-4fd0771d8316", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510592Z", "modified": "2026-06-14T11:55:48.510592Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4800fc5-dad9-5edf-8e13-bf7294c8fc79", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510736Z", "modified": "2026-06-14T11:55:48.510736Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--856e7c80-85be-586c-b844-f1a41b27412f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510878Z", "modified": "2026-06-14T11:55:48.510878Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9ea84847-7a0d-5063-ac27-8d54709f9435", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.510999Z", "modified": "2026-06-14T11:55:48.510999Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86f6d08c-3c55-5d94-8244-dc918d85963e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511113Z", "modified": "2026-06-14T11:55:48.511113Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03693adc-837e-5781-9fd7-480c3728b10a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511256Z", "modified": "2026-06-14T11:55:48.511256Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--695ece43-8cd9-560b-9c65-43b47302555d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511372Z", "modified": "2026-06-14T11:55:48.511372Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a8c3cbb-972e-5bcc-b8a1-a0ca9bb36171", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511539Z", "modified": "2026-06-14T11:55:48.511539Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21513e98-0794-5394-9e43-94f76a623a9e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511658Z", "modified": "2026-06-14T11:55:48.511658Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6eb0aa2-f8c0-5a4a-aeb4-ea30ff2cc830", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511786Z", "modified": "2026-06-14T11:55:48.511786Z", "relationship_type": "uses", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d6a08a6-212e-5f1a-8a1d-85e3d02ddf5e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.511932Z", "modified": "2026-06-14T11:55:48.511932Z", "relationship_type": "communicates-with", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7393f24e-8bf0-5c56-9c56-bf11e8af3ef4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512052Z", "modified": "2026-06-14T11:55:48.512052Z", "relationship_type": "exploits", "source_ref": "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a4a1659-4bd3-51ca-a063-95785d1beeb6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512167Z", "modified": "2026-06-14T11:55:48.512167Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4183408-c860-5bf0-acf0-54cf79f3d43f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512308Z", "modified": "2026-06-14T11:55:48.512308Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d15821e-b8d3-5f4f-bf49-d76d99ef0410", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512431Z", "modified": "2026-06-14T11:55:48.512431Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb9fb4c2-f634-5f5a-9381-ab07ff72fd5e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512566Z", "modified": "2026-06-14T11:55:48.512566Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29f401a4-1522-5baa-9fdf-9b1a4b0eb867", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512674Z", "modified": "2026-06-14T11:55:48.512674Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33823417-683e-55fc-b80b-851b755f25b9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.51279Z", "modified": "2026-06-14T11:55:48.51279Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f33a1822-ca4e-5e82-a077-115e9d27fec2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.512912Z", "modified": "2026-06-14T11:55:48.512912Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba972a6b-ddac-51b3-b374-e1275080929f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513065Z", "modified": "2026-06-14T11:55:48.513065Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--459e9cbf-bd10-523e-bd99-114c66cdfecf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513192Z", "modified": "2026-06-14T11:55:48.513192Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8cf72ec-04c8-5e5f-8111-54ba8553b584", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513309Z", "modified": "2026-06-14T11:55:48.513309Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9bcc804-4ecb-5a33-a7d9-4fc2679ff0de", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513423Z", "modified": "2026-06-14T11:55:48.513423Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0556041b-a82a-58d1-a31b-184f447cea6c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513616Z", "modified": "2026-06-14T11:55:48.513616Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6728183-885a-50fa-a174-f78f4f279578", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513779Z", "modified": "2026-06-14T11:55:48.513779Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f8b3da3-c786-5089-9e8a-443ff78f54ac", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.513922Z", "modified": "2026-06-14T11:55:48.513922Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c230c264-3ad3-5449-a817-1510f5d4530d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514089Z", "modified": "2026-06-14T11:55:48.514089Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47c27c79-9486-5c9c-a62e-a5db4896cbdd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514206Z", "modified": "2026-06-14T11:55:48.514206Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c00eef7-852e-5684-88bf-a7beaa989a79", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514318Z", "modified": "2026-06-14T11:55:48.514318Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a02cf34a-071a-5d5a-9e96-6988d44d2a26", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514432Z", "modified": "2026-06-14T11:55:48.514432Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab4cda07-f983-5bd9-976e-fb52f4a0004a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514543Z", "modified": "2026-06-14T11:55:48.514543Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99bfac68-6d49-5ce9-b353-cef62618e294", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514651Z", "modified": "2026-06-14T11:55:48.514651Z", "relationship_type": "uses", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f111661f-5782-51c6-9e5c-03a2214d3109", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514767Z", "modified": "2026-06-14T11:55:48.514767Z", "relationship_type": "communicates-with", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4a4840b-d4f0-5d19-9397-3bd2ba8be648", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.514904Z", "modified": "2026-06-14T11:55:48.514904Z", "relationship_type": "exploits", "source_ref": "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1aca9bb0-0408-5c21-ac52-92ca478b1a8c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515027Z", "modified": "2026-06-14T11:55:48.515027Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df62d37d-0ffe-5a82-ab5f-1e6bb9972c4d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515137Z", "modified": "2026-06-14T11:55:48.515137Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d6e52aa-c7b5-5ed1-8aab-ae011e0ff16a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515246Z", "modified": "2026-06-14T11:55:48.515246Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58e7878d-08e7-5ac3-86cc-3a0bf8f60c19", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515353Z", "modified": "2026-06-14T11:55:48.515353Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--68dce433-8ac9-5230-a5b3-921fe67339d0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515463Z", "modified": "2026-06-14T11:55:48.515463Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9216ffc-4625-57dc-9274-e03d417feca8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515585Z", "modified": "2026-06-14T11:55:48.515585Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e98eeaa-41af-5546-a82c-5edea8e77a9b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515697Z", "modified": "2026-06-14T11:55:48.515697Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3d424cc4-92ea-58c5-ae41-083fe4985b35", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.51581Z", "modified": "2026-06-14T11:55:48.51581Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ca55789-ba43-595f-925c-5f457100f00c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.515937Z", "modified": "2026-06-14T11:55:48.515937Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ec90fd0-f62b-55e6-9e2f-b24f00218bc4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516051Z", "modified": "2026-06-14T11:55:48.516051Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4080d283-e9c7-58aa-b78a-95df304eae53", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516163Z", "modified": "2026-06-14T11:55:48.516163Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a39200b5-2ef2-5a76-a4a1-f1bd75171276", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516273Z", "modified": "2026-06-14T11:55:48.516273Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de87162f-0ac9-5d7a-a1fd-d0f1c8256dca", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516379Z", "modified": "2026-06-14T11:55:48.516379Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--13d0445b-668f-5b38-8374-7de38602a4c8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516503Z", "modified": "2026-06-14T11:55:48.516503Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e79c3a76-0f58-5c9b-8cf8-3bd72bb9fbe4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516616Z", "modified": "2026-06-14T11:55:48.516616Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4460fdc5-78f3-5c6c-afb1-481e12a713c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516727Z", "modified": "2026-06-14T11:55:48.516727Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a8e848e-5be8-576b-b5a3-8d65300d34e6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516859Z", "modified": "2026-06-14T11:55:48.516859Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3c3e4418-7946-5778-b3f1-6987885d13b8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.516984Z", "modified": "2026-06-14T11:55:48.516984Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6870f799-aaec-5d9b-a08d-50c9f36a7ee7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.517104Z", "modified": "2026-06-14T11:55:48.517104Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9f0ce4f-14ba-5c82-a475-1ff30a18804e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.51723Z", "modified": "2026-06-14T11:55:48.51723Z", "relationship_type": "uses", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29949733-8a39-5bd5-b0e2-c165e998845b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.517416Z", "modified": "2026-06-14T11:55:48.517416Z", "relationship_type": "communicates-with", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1222cdc7-72c2-5391-a02e-0a71c999484a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.517595Z", "modified": "2026-06-14T11:55:48.517595Z", "relationship_type": "exploits", "source_ref": "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a84a83ac-ad30-53d3-9e4c-a49991217a56", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.517808Z", "modified": "2026-06-14T11:55:48.517808Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25d5764c-bd20-5958-8d37-e7adfb95d0f8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.517997Z", "modified": "2026-06-14T11:55:48.517997Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a66d2b73-7a8c-5554-ac07-fc908ddd118c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.518181Z", "modified": "2026-06-14T11:55:48.518181Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74650b70-3b41-5ead-b9ff-734f4a1274af", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.518405Z", "modified": "2026-06-14T11:55:48.518405Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f115835d-0c59-53ce-9d52-4af2cf331d12", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.518681Z", "modified": "2026-06-14T11:55:48.518681Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5029737-73f4-5366-aa56-32c92dcccae1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.518872Z", "modified": "2026-06-14T11:55:48.518872Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef201b69-e915-5fed-b9cf-7ecce4bcbf39", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.51905Z", "modified": "2026-06-14T11:55:48.51905Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb33325d-6758-58ba-8efe-8fa991bc5db9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.519217Z", "modified": "2026-06-14T11:55:48.519217Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80e8b3f4-45ae-5878-aaea-be4c5315b766", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.519382Z", "modified": "2026-06-14T11:55:48.519382Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e677d062-b2c4-5ed8-b7c8-a256bc4e2ba6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.519647Z", "modified": "2026-06-14T11:55:48.519647Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb9fd373-3b6f-57d1-be1b-2bf3246af8ff", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.519829Z", "modified": "2026-06-14T11:55:48.519829Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1a6afa0-9594-5de3-a77f-ef8f2c28ff3d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.519997Z", "modified": "2026-06-14T11:55:48.519997Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b0e3d95-d280-5fe7-b839-969e44f752a5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.520181Z", "modified": "2026-06-14T11:55:48.520181Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d011025d-7fc6-5eb7-9b24-7dfc788ca498", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.520371Z", "modified": "2026-06-14T11:55:48.520371Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7dfb4e33-9b6b-5d94-90d3-46936f3fd6c5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.520554Z", "modified": "2026-06-14T11:55:48.520554Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--227efb4f-c326-5369-bc2d-e001949177f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.520735Z", "modified": "2026-06-14T11:55:48.520735Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fa17363-2e88-5f47-841c-670e25f9f494", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.520914Z", "modified": "2026-06-14T11:55:48.520914Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--418a9719-c2f3-5f86-b9f3-25b7cb238851", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521096Z", "modified": "2026-06-14T11:55:48.521096Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ec77739-f09d-5ab0-8d80-90686c732405", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521292Z", "modified": "2026-06-14T11:55:48.521292Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e00eee00-fa1b-58ac-8e1e-06e60a9ab385", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521469Z", "modified": "2026-06-14T11:55:48.521469Z", "relationship_type": "uses", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f156b70a-1c36-57ef-add3-bf4f29e6e526", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521686Z", "modified": "2026-06-14T11:55:48.521686Z", "relationship_type": "communicates-with", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f98b3a17-fea0-5b2b-a66c-57280901ee9a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521836Z", "modified": "2026-06-14T11:55:48.521836Z", "relationship_type": "exploits", "source_ref": "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f47693c-8e56-52e8-80e2-27a1b6f4014e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.521966Z", "modified": "2026-06-14T11:55:48.521966Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0d859e9-e660-5391-b6b3-1a0634ea055f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522085Z", "modified": "2026-06-14T11:55:48.522085Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--455d812e-73e5-5657-b779-a90d342f1183", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522202Z", "modified": "2026-06-14T11:55:48.522202Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd2773ac-06af-5878-9a60-b126195191c3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522311Z", "modified": "2026-06-14T11:55:48.522311Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3e22d75-2d7b-5cf2-ad4a-e8f67ca59b89", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522429Z", "modified": "2026-06-14T11:55:48.522429Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d58bdb3-cb1c-569f-9c3e-7f4513263024", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522554Z", "modified": "2026-06-14T11:55:48.522554Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b9bac38-df8a-5a09-a00f-a889ae8bf300", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522681Z", "modified": "2026-06-14T11:55:48.522681Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--730a311a-7125-5bff-936f-f4f29c145cd3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522813Z", "modified": "2026-06-14T11:55:48.522813Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a57eea08-198b-557f-ac5e-8287afb60fb5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.522938Z", "modified": "2026-06-14T11:55:48.522938Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--def42d8d-fcc4-522c-aac6-1d7185e23336", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523069Z", "modified": "2026-06-14T11:55:48.523069Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79baa295-a7b9-5fb2-a7ee-67efca518d01", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523213Z", "modified": "2026-06-14T11:55:48.523213Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1dd96872-2f36-568c-ac58-a2dbb8512530", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523339Z", "modified": "2026-06-14T11:55:48.523339Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b9b1b12-b589-5866-8332-721cb82c1ce7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523452Z", "modified": "2026-06-14T11:55:48.523452Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e015231c-3e86-5ee2-b351-3f7faeac301c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523569Z", "modified": "2026-06-14T11:55:48.523569Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db454347-53b4-550a-b237-78efe81d399e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523678Z", "modified": "2026-06-14T11:55:48.523678Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67c3dce6-6c6b-5fce-8b2a-1d81319d23ee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523785Z", "modified": "2026-06-14T11:55:48.523785Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a01acb2-8d1f-5b83-b42e-4b54b6fa4f8a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.523911Z", "modified": "2026-06-14T11:55:48.523911Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72497efc-5e5c-5472-ad7d-06a8273c974a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524026Z", "modified": "2026-06-14T11:55:48.524026Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--064f3210-91cf-5b38-8fcf-99a8529bfaf1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.52428Z", "modified": "2026-06-14T11:55:48.52428Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa9c3205-fa43-5f9d-a7aa-99b14732899e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524404Z", "modified": "2026-06-14T11:55:48.524404Z", "relationship_type": "uses", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b86a0163-774c-5834-afd5-660b582b7d5a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524517Z", "modified": "2026-06-14T11:55:48.524517Z", "relationship_type": "communicates-with", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25d179bf-606c-5d76-8976-8a176f3dcffe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524622Z", "modified": "2026-06-14T11:55:48.524622Z", "relationship_type": "exploits", "source_ref": "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c8ea2a7-9c60-594f-baf6-6d214fd8ee27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524742Z", "modified": "2026-06-14T11:55:48.524742Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9a256f7-75c7-5463-a903-e6acd04f2c2f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524861Z", "modified": "2026-06-14T11:55:48.524861Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--166960a7-e2e5-58a6-a1ff-63cdade630d2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.524966Z", "modified": "2026-06-14T11:55:48.524966Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--885c672c-53e4-5a51-96b2-0a4abd559ec5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525074Z", "modified": "2026-06-14T11:55:48.525074Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3828b39-2b58-5b34-815e-ad4cc4358b79", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525192Z", "modified": "2026-06-14T11:55:48.525192Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00101c8a-4a88-5399-8b9a-3facfdaa9688", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525301Z", "modified": "2026-06-14T11:55:48.525301Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6c73e71-bc65-5687-9e3a-83b8ffa9910f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525406Z", "modified": "2026-06-14T11:55:48.525406Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc29cf1b-cdd6-57fa-b3f2-9b3da5ebfa14", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525514Z", "modified": "2026-06-14T11:55:48.525514Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b06d2e4d-9459-5438-9177-ab8c973d400d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525623Z", "modified": "2026-06-14T11:55:48.525623Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab51f7f0-ddfd-580b-ac9e-a7fa0f3a3d4c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525732Z", "modified": "2026-06-14T11:55:48.525732Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb709231-8d5b-5cbf-beac-cd47c802036e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525841Z", "modified": "2026-06-14T11:55:48.525841Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36bcdbcb-355f-56e2-b994-e347dabf0e51", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.525949Z", "modified": "2026-06-14T11:55:48.525949Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0bfd029b-03b4-5702-8f44-1720f1ce13e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526057Z", "modified": "2026-06-14T11:55:48.526057Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d0d504e-9c75-51f4-abf0-1746ad6fdaf4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526165Z", "modified": "2026-06-14T11:55:48.526165Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a839d29-6fda-57a8-8344-5df69293d561", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526276Z", "modified": "2026-06-14T11:55:48.526276Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ef2cd26-5059-5278-aef0-d59e32878000", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526408Z", "modified": "2026-06-14T11:55:48.526408Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb30ccc2-1545-546a-a462-146e013b959e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526525Z", "modified": "2026-06-14T11:55:48.526525Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b47b8e1-21b7-5961-a55b-2f8af5ad6b38", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526652Z", "modified": "2026-06-14T11:55:48.526652Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31a9883c-dd90-5567-995d-18b9b38414bf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526765Z", "modified": "2026-06-14T11:55:48.526765Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43f5843d-a985-5144-b023-545b729db93b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.526889Z", "modified": "2026-06-14T11:55:48.526889Z", "relationship_type": "uses", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1db5275d-0111-5f35-b855-571b3979aaef", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527017Z", "modified": "2026-06-14T11:55:48.527017Z", "relationship_type": "communicates-with", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4c30161-bce0-5e3b-940b-7cef8197713c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527155Z", "modified": "2026-06-14T11:55:48.527155Z", "relationship_type": "exploits", "source_ref": "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77273ecd-739c-5194-8ed2-e443b0578bd3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527296Z", "modified": "2026-06-14T11:55:48.527296Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ab1f6a5-7e29-553d-b811-b35675e8be6b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527414Z", "modified": "2026-06-14T11:55:48.527414Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93f43e41-0d13-5d25-8484-6a89f428b661", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527524Z", "modified": "2026-06-14T11:55:48.527524Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91afb86f-b350-51c3-9dd2-0855fdabe594", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527633Z", "modified": "2026-06-14T11:55:48.527633Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65ec254e-9db0-5ef2-9349-a06f5e511af3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527745Z", "modified": "2026-06-14T11:55:48.527745Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e907080b-8d9d-54f3-8955-7334fe176208", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.527868Z", "modified": "2026-06-14T11:55:48.527868Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b3cf33d-d2bf-5829-8c8b-255220b972b2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528001Z", "modified": "2026-06-14T11:55:48.528001Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b8e434e-7be8-5e70-9ede-70e074a6d8b8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528191Z", "modified": "2026-06-14T11:55:48.528191Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34142e4f-4d8e-54db-8389-09c81a6e6fdc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528369Z", "modified": "2026-06-14T11:55:48.528369Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ece71e8f-61b2-56f8-9964-6e93b3c7c92c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528527Z", "modified": "2026-06-14T11:55:48.528527Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3689544-6274-549b-87df-3394dc89f889", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528695Z", "modified": "2026-06-14T11:55:48.528695Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56778e48-083e-55bd-b623-b6906bd6b368", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.528865Z", "modified": "2026-06-14T11:55:48.528865Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be5605d4-b85c-5fef-bb06-2a22e90c0e34", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.529045Z", "modified": "2026-06-14T11:55:48.529045Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b54efe90-e5bc-5352-817e-0928af5eeadf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.529225Z", "modified": "2026-06-14T11:55:48.529225Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c18982d-2f61-568d-863d-a98a66b3769b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.529381Z", "modified": "2026-06-14T11:55:48.529381Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bac578d1-df9f-52f1-a638-1cb2f272b3a9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.529554Z", "modified": "2026-06-14T11:55:48.529554Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9521116-e12f-5035-b281-55e220cc824b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.529687Z", "modified": "2026-06-14T11:55:48.529687Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1b7b1e0b-4c8e-5c69-bbf0-bd8cf1e3eb1e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.52987Z", "modified": "2026-06-14T11:55:48.52987Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8560cb7-3a5a-5a47-befb-0d4d022a544a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.53005Z", "modified": "2026-06-14T11:55:48.53005Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18564e17-6ae7-5934-af8e-b2b9dc2582bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.530243Z", "modified": "2026-06-14T11:55:48.530243Z", "relationship_type": "uses", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aef1632c-1133-5890-b110-16e3dd7d10b1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.530423Z", "modified": "2026-06-14T11:55:48.530423Z", "relationship_type": "communicates-with", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--223c4364-efd0-52ab-b414-97b899cd9156", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.530608Z", "modified": "2026-06-14T11:55:48.530608Z", "relationship_type": "exploits", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73b7939d-23ec-5a5c-9054-e4999eaf8950", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.530808Z", "modified": "2026-06-14T11:55:48.530808Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--2eaef1c0-1b00-58e1-a7df-761e3586797d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad7559ad-7574-562f-8e7e-8710953bb311", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.530995Z", "modified": "2026-06-14T11:55:48.530995Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--d4d00aae-6a88-5829-946b-e0c9afcc9d11", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d66e640-0d64-5013-a627-0e0268d48e30", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.531179Z", "modified": "2026-06-14T11:55:48.531179Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--9056c14c-e267-5f9c-9c20-c1c706e590e3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--89c15d03-f72c-50de-8c66-5c926dd257cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.531365Z", "modified": "2026-06-14T11:55:48.531365Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--69c99921-0cd1-5d9c-84fb-a7f39dd061e3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--54114cee-cd95-5bd7-a2fd-ad6100fa4900", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.531528Z", "modified": "2026-06-14T11:55:48.531528Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--d3f7b47d-d1a7-5ce5-a8cf-3d512c311e0c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d11ab1e2-2573-5049-84e0-b3480dad9045", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.531712Z", "modified": "2026-06-14T11:55:48.531712Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--a1f40bc4-160a-53a0-b3e7-335de782ebd3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b02a8d18-2a47-54bf-87fd-9509da66adaf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.531891Z", "modified": "2026-06-14T11:55:48.531891Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--63ce5b8f-adb3-5b41-bfbe-e07f9e40c609", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c76cc1e-28fb-5024-bf95-0a9f48dd46fc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532075Z", "modified": "2026-06-14T11:55:48.532075Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--f381d190-a6c7-55a6-b330-a67caf12e542", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa047e80-6b67-552a-8b10-36c4bcb36817", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532247Z", "modified": "2026-06-14T11:55:48.532247Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--7011d2a2-4da3-50db-99dc-a12ffec1cba1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70385826-323e-5d51-9132-a0125a9760b3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532394Z", "modified": "2026-06-14T11:55:48.532394Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--b3b12109-4f2f-54c7-87f7-b3398ea698b0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32d50c01-a1f1-55be-a7b9-5d5c5b0bd57c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532506Z", "modified": "2026-06-14T11:55:48.532506Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--830ad337-5c1b-5f17-ba43-9727d02f38f8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a58d380-cee0-5a42-b75d-3bee58276477", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532616Z", "modified": "2026-06-14T11:55:48.532616Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--e45a98ad-052a-560d-9d30-9558293a128e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--252232af-f1a8-5bac-a474-365d5e587683", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532737Z", "modified": "2026-06-14T11:55:48.532737Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--cd501157-8cc7-5e45-9923-15b907e91a5f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb7ea418-638c-5fa8-8ddf-a78649405480", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.532848Z", "modified": "2026-06-14T11:55:48.532848Z", "relationship_type": "related-to", "source_ref": "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "target_ref": "tool--696d88bf-8cb9-5020-b8d3-a89606343b2d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--d334d776-c26a-566a-89b7-e513db9b7882", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:55:48.533133Z", "modified": "2026-06-14T11:55:48.533133Z", "name": "Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host", "description": "Most samples are PUBLIC tooling. The five operator-recompiled .NET tools (EfsPotato, GodPotato, SweetPotato, Rubeus, SharpSuccessor) are identified as their public counterparts via YARA HKTL-GUID + VT detection + capa signature, NOT byte-for-byte public-release hash identity. Only bespoke compiled code = cmd_exec.dll (custom BUILD of a known MSSQL CLR technique, not novel). CVE-2026-20817_PoC.exe is a non-weaponized demo PoC of a Jan-2026-patched CVE. EXCLUDED per analyst guardrails: proxy-era ports 5222-5455 (different-tenant/reallocation risk), benign VT downloaded_files (autodiscover.xml, :1337 dir-index page), inostage.ru/panel.inostage.ru (public-tool co-host noise), and generic .NET runtime imphashes f34d5f2d.../dae02f32... (non-discriminating stubs).\nFalse-positive notes:\n- 67.215.232.25 is on shared hosting (HostPapa/ColoCrossing, AS36352) \u2014 IP block covers the known infra but confirm port/service context before broad blocking of the /21.\n- The native-tool and operator-recompiled .NET hashes are widely-shared public hacktools; presence indicates hacktool staging but not necessarily this specific operator. The bespoke cmd_exec.dll SHA256 (a7029ef2...) and the [*] Connected to SQL Server CLR backdoor banner are the operator-specific anchors.\n- Werkzeug/3.1.6 and Python 3.12.3 are common \u2014 the /health JSON field-combo (active_servers+pending_commands+completed_commands+status+timestamp) is the discriminating C2 signature, not the server banner alone.\n- Aatrox is a League-of-Legends champion name in common use; treat as a commodity webshell password/eval-param, not an operator identity artifact.", "report_types": [ "threat-report" ], "published": "2026-06-12T00:00:00Z", "object_refs": [ "ipv4-addr--c1adb7e2-fff9-5e44-a48a-d0f33cc6306b", "indicator--3877e5cf-fb53-54e7-880c-5c91e2f8a645", "url--03bc5937-18aa-5dc4-9b6d-d104eab5c447", "indicator--eae13405-8811-57c2-a2d1-604d21047010", "url--952fa149-1219-5b62-a263-57b4d01c73a5", "indicator--a886d819-6220-516c-9dde-6b3d9513fd9e", "url--21b24b19-dc00-523c-8492-f50ddea4d33e", "indicator--67638387-0cfa-533d-81ce-6bfb746fc7fe", "url--54f4d123-02a9-509f-a353-92bd51629526", "indicator--355cbdf6-8f2e-5a31-b8ce-cc60270d59c9", "url--8a79aa55-54db-5223-a507-70fb98d3b9ce", "indicator--2a6f0488-c4d7-55a7-8a5d-7369c77dbbe9", "file--ddf10f38-4126-5b95-a27d-6859c49b2335", "indicator--16ca4f73-efbe-5345-8008-6b510ea585e2", "file--b64ac1d0-6615-57d8-9dcf-e80af29dd787", "file--d80710c4-423c-574c-8264-314d5b3ef020", "file--e8b3eb55-2a64-5ab7-bfc3-80ba7195121d", "file--c48d0c72-69d3-51c5-8d2f-0c68b51ec8f0", "file--ab9eeb5e-f564-586e-a339-5722f356d0dd", "file--99f29585-fd5c-57ce-b967-0fbaf6538a88", "file--708e9fbc-fb3a-5aa9-8626-9780954afa20", "file--c823cb52-ddab-5978-a468-70e1b590a30e", "file--1d7c16e6-52fe-5497-afe5-96268cb96d43", "file--3b200d62-3c88-528b-b3c0-8f8edaeb6377", "file--d6487037-ea5b-5e6a-81dd-5d79522da177", "file--8dc402ef-f6ea-5b09-a6ba-661072d42d37", "file--dbace70b-9543-5516-a437-8785a7968313", "file--08d936c5-9ea2-56df-b51d-f3658e36657d", "file--ad827f0b-9cd8-5a6b-b774-d1d2ffb04f4b", "file--98013292-ae0e-5efe-82ab-c5959fd28a00", "file--3c086315-7e19-51bb-9109-943301b00ea2", "file--5e1d1d00-10e2-5bc3-8ae5-cfb2090d298a", "file--624348c9-1282-54e4-9cc3-402592f90483", "file--fb177e24-a7c3-583e-beb0-b420361b449c", "indicator--d07b51f3-2144-5e42-9188-fc513ca5d541", "indicator--c39710ab-b86b-5f24-9825-eb6fcfd0a1f0", "indicator--538ac55d-fe46-5539-8fe5-53c8fde071ba", "indicator--dcab50b8-aada-5814-a04b-83ef5cd256c9", "indicator--f3439843-180a-5c92-8902-025b8a45129b", "indicator--c6241708-06a2-54cd-9b31-97a172dd1fdc", "indicator--7457c594-cb79-5bdd-b42a-5864f0fd905d", "indicator--6fe164cd-cb34-5587-b580-c117d19895aa", "indicator--faf535a2-72a7-5b71-ae18-4c445b091c33", "indicator--958a1475-95fb-5ee2-b589-882c7165b012", "indicator--e3da29db-1e46-5fe2-a522-8694ce61c7d2", "indicator--54123630-9eb0-5171-96d5-83857061f599", "indicator--78df0b7a-723e-5bd4-a727-20e7517ea4ba", "indicator--6cb61dd1-7866-5756-83e2-28d035e64cfe", "malware--c4bd0ac2-a9cd-543e-af3d-7e69015cfb7e", "malware--ba981707-08e0-5cca-b0ee-9bb3915684d1", "malware--c9bdf629-b380-544e-89dc-ef8453a1add3", "malware--0ea32953-091a-5fdd-9cee-eb5621448c11", "malware--4f6c09cf-ddff-56e4-8a55-2c6b1ef8f85b", "malware--b6aeaaf3-b35b-5a7e-9308-b653d34f9ef3", "malware--745ce1ca-5c45-51c0-97c9-4253e7227600", "malware--07a41fcc-c9f2-52b1-b761-c505194eaee8", "malware--08ffdc45-11cc-5c58-a706-cdf2bcc18fae", "tool--2eaef1c0-1b00-58e1-a7df-761e3586797d", "tool--d4d00aae-6a88-5829-946b-e0c9afcc9d11", "tool--9056c14c-e267-5f9c-9c20-c1c706e590e3", "tool--69c99921-0cd1-5d9c-84fb-a7f39dd061e3", "tool--d3f7b47d-d1a7-5ce5-a8cf-3d512c311e0c", "tool--a1f40bc4-160a-53a0-b3e7-335de782ebd3", "tool--63ce5b8f-adb3-5b41-bfbe-e07f9e40c609", "tool--f381d190-a6c7-55a6-b330-a67caf12e542", "tool--7011d2a2-4da3-50db-99dc-a12ffec1cba1", "tool--b3b12109-4f2f-54c7-87f7-b3398ea698b0", "tool--830ad337-5c1b-5f17-ba43-9727d02f38f8", "tool--e45a98ad-052a-560d-9d30-9558293a128e", "tool--cd501157-8cc7-5e45-9923-15b907e91a5f", "tool--696d88bf-8cb9-5020-b8d3-a89606343b2d", "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "attack-pattern--5c3642e3-a066-570d-ac16-64fbae2e162b", "attack-pattern--fd8dd968-9ef8-5d44-9278-54e070789645", "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "attack-pattern--bf2e732a-6a28-5d26-91a4-e01243eefafe", "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "attack-pattern--28091db6-87a8-5b9f-8e80-605a0bf6ca6a", "attack-pattern--2c8a99e6-e85d-5633-9fc5-48020c0aafce", "attack-pattern--2b613316-6a4f-5cbd-ad25-9e251342eb43", "attack-pattern--14aaa264-56aa-5e31-8352-562828701084", "attack-pattern--a61e4ca6-cb7f-5984-9dfc-e7b181db793a", "attack-pattern--67d44796-f83b-58ac-987b-5a89b207b966", "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "attack-pattern--ef0e325b-e222-5686-aa18-a7f7594fe874", "infrastructure--4608b817-4ca1-58b0-979f-bc327b35323a", "vulnerability--6e5ba492-fc01-5fe7-bf5a-51c4cc41296c", "relationship--7fc9d260-d1a0-51ec-8c85-9ef69a04b177", "relationship--372b7e14-1bae-55d8-96fa-e04ad9836e76", "relationship--f5931caa-fa81-5034-9437-64816949f223", "relationship--4fa46841-0768-520d-9875-9ec02d9c20c1", "relationship--ae14c1f3-a69a-5a54-acbf-d1581573127d", "relationship--957159be-d8d3-552f-a701-03af1075c79a", "relationship--2b27ceae-d2c2-5cf4-8e52-36428e5bc058", "relationship--24e44a64-97b3-566a-a028-2a73f4d921bc", "relationship--0b3d7cdf-c824-564d-afa3-60acd7b40214", "relationship--ce2cdedb-8c50-5b2b-bc0f-d7daf92c52f0", "relationship--af05ef00-4dde-5ab8-bfc9-3a6fdf0972dc", "relationship--dd47b930-7d22-51ed-becf-eb04cb4cabc6", "relationship--05633a2e-a12e-5986-888d-51b92935ee22", "relationship--60b40f4c-366e-51c6-b152-5bdf0e025d5f", "relationship--72503b72-d067-58bc-865d-871d0082d939", "relationship--628d0fc7-8a63-5142-b15a-e5d82e550aeb", "relationship--c25399e8-f6d9-5c03-84de-b04199d1fc4d", "relationship--5e5e9628-2d8b-55c1-8d55-393a3a3a4796", "relationship--f1e56d32-e633-5a00-8b83-087a8a3951fd", "relationship--a301e198-adaa-59e9-b84b-cd7177aa4c71", "relationship--eb150823-6f86-5042-beac-ad3742844ab9", "relationship--902d6d0f-efe8-5072-8d11-14198f077f0f", "relationship--6570a235-a393-58b1-a6b1-cfb446192bd2", "relationship--3981e072-cf79-54d5-8168-aa97fd965393", "relationship--2bb20083-7df2-5021-9067-deca8663d979", "relationship--97779d0f-069f-5b87-ab37-5b5b53602e67", "relationship--569d0c61-e837-5c5e-ae7c-15ba16c37f3b", "relationship--9a6eebd3-199b-5c6e-847f-638190ebc1eb", "relationship--e404a982-7927-5817-a8f8-972c0d999af7", "relationship--408a4376-79cb-51ac-84ba-290492b68ed7", "relationship--a66a80c8-68e2-597a-9701-2f5c43261e47", "relationship--9456138e-dea0-5a2f-9d45-fc5c38838a97", "relationship--5e101d35-1d1e-5dcb-93b1-9391d4704a66", "relationship--af5886b3-42bc-51af-ae95-d38f80f9ac4c", "relationship--77b4000d-3dd0-5f6c-9395-fde4834fe665", "relationship--2b87bc9d-4b17-5e63-9342-8fe85de3fbc2", "relationship--d68b015a-d401-5fbc-a2ef-70d998fbe5f2", "relationship--df05dbac-2576-5a3b-880d-125bc482b76b", "relationship--180ccbb9-f8c9-5257-bf7f-6b82ef17ba71", "relationship--d4328b84-747a-59f8-81e8-3560efe8e3ec", "relationship--57e01fa2-628d-5f61-8fb0-94576be9b5f7", "relationship--9a12adda-9ac6-5b97-904f-eaaba652c120", "relationship--0ff5be14-d12c-5c4d-a8d7-3361e4115189", "relationship--2ef4d9d8-1209-531e-ab7c-ba1c84a4c136", "relationship--e78151af-9562-52b5-840b-458dd2559377", "relationship--49779b76-a33c-5339-b0c2-2186b43403d7", "relationship--f443c2f5-9747-57ff-83ec-e7431b1d552a", "relationship--0b61d5c4-3f0c-5966-b314-35660757b689", "relationship--76b13899-0cb5-5902-aa60-b6bc6b8e9596", "relationship--3d7881a6-5285-557a-9a4b-436dd5aae5b9", "relationship--6dbb443f-d342-5e86-8417-ebf7e6627477", "relationship--b14454d1-e6bf-526c-a5a6-0a7eff7b52b0", "relationship--5095c80a-ad55-58b3-aeda-2fee590376f4", "relationship--d6252edf-c7f8-599f-aa47-bc2fb62dbd46", "relationship--70b86331-09bd-5ee7-a510-ef944551f91b", "relationship--c61da364-ef22-5b5f-8b3e-9a5ad866044b", "relationship--4fee7df4-3503-5b01-9121-d31944544f8e", "relationship--eec16073-c1fd-5aaf-aebb-16abf3a76be1", "relationship--1c93a8b5-266a-5ee5-960e-78a566936d1c", "relationship--f1b4e46c-d552-5882-9325-3a1ef0f1dcdf", "relationship--9945c8b6-3ef1-5f91-9adb-fc4db379f294", "relationship--7311bce1-93c9-57a8-8025-f52318c30c1c", "relationship--5d29ceff-f454-5867-b7f8-9f8c53b9ea5b", "relationship--9c624f2f-8b38-5d15-92c0-826260489871", "relationship--38bed784-8124-58db-a1ad-4e3ef6af03db", "relationship--954db5df-2e32-54fd-80aa-fde8647451c0", "relationship--6ad5c378-879d-5212-9bcb-3ebf5b1451dc", "relationship--7bd06925-7480-5a0d-841d-8d9abd988ba8", "relationship--761d2673-8f15-5846-a84a-49b864d3a16d", "relationship--5058a1b8-df9e-58c3-a5c5-88e99cc10534", "relationship--5fb9bb68-e3c4-5336-9896-94ffb31d140b", "relationship--93932a68-7501-55cf-b912-5a16a015aeda", "relationship--ea5a9b34-f43f-5a59-a05f-40612ca683f7", "relationship--832a5d78-0c74-57ed-a7b1-4244c2495dec", "relationship--b077141e-4e81-5c6d-bff3-f7ea8842bd49", "relationship--5117c00b-0f1f-50e5-860e-4fd0771d8316", "relationship--a4800fc5-dad9-5edf-8e13-bf7294c8fc79", "relationship--856e7c80-85be-586c-b844-f1a41b27412f", "relationship--9ea84847-7a0d-5063-ac27-8d54709f9435", "relationship--86f6d08c-3c55-5d94-8244-dc918d85963e", "relationship--03693adc-837e-5781-9fd7-480c3728b10a", "relationship--695ece43-8cd9-560b-9c65-43b47302555d", "relationship--6a8c3cbb-972e-5bcc-b8a1-a0ca9bb36171", "relationship--21513e98-0794-5394-9e43-94f76a623a9e", "relationship--f6eb0aa2-f8c0-5a4a-aeb4-ea30ff2cc830", "relationship--6d6a08a6-212e-5f1a-8a1d-85e3d02ddf5e", "relationship--7393f24e-8bf0-5c56-9c56-bf11e8af3ef4", "relationship--3a4a1659-4bd3-51ca-a063-95785d1beeb6", "relationship--a4183408-c860-5bf0-acf0-54cf79f3d43f", "relationship--9d15821e-b8d3-5f4f-bf49-d76d99ef0410", "relationship--bb9fb4c2-f634-5f5a-9381-ab07ff72fd5e", "relationship--29f401a4-1522-5baa-9fdf-9b1a4b0eb867", "relationship--33823417-683e-55fc-b80b-851b755f25b9", "relationship--f33a1822-ca4e-5e82-a077-115e9d27fec2", "relationship--ba972a6b-ddac-51b3-b374-e1275080929f", "relationship--459e9cbf-bd10-523e-bd99-114c66cdfecf", "relationship--f8cf72ec-04c8-5e5f-8111-54ba8553b584", "relationship--f9bcc804-4ecb-5a33-a7d9-4fc2679ff0de", "relationship--0556041b-a82a-58d1-a31b-184f447cea6c", "relationship--a6728183-885a-50fa-a174-f78f4f279578", "relationship--9f8b3da3-c786-5089-9e8a-443ff78f54ac", "relationship--c230c264-3ad3-5449-a817-1510f5d4530d", "relationship--47c27c79-9486-5c9c-a62e-a5db4896cbdd", "relationship--1c00eef7-852e-5684-88bf-a7beaa989a79", "relationship--a02cf34a-071a-5d5a-9e96-6988d44d2a26", "relationship--ab4cda07-f983-5bd9-976e-fb52f4a0004a", "relationship--99bfac68-6d49-5ce9-b353-cef62618e294", "relationship--f111661f-5782-51c6-9e5c-03a2214d3109", "relationship--d4a4840b-d4f0-5d19-9397-3bd2ba8be648", "relationship--1aca9bb0-0408-5c21-ac52-92ca478b1a8c", "relationship--df62d37d-0ffe-5a82-ab5f-1e6bb9972c4d", "relationship--8d6e52aa-c7b5-5ed1-8aab-ae011e0ff16a", "relationship--58e7878d-08e7-5ac3-86cc-3a0bf8f60c19", "relationship--68dce433-8ac9-5230-a5b3-921fe67339d0", "relationship--e9216ffc-4625-57dc-9274-e03d417feca8", "relationship--6e98eeaa-41af-5546-a82c-5edea8e77a9b", "relationship--3d424cc4-92ea-58c5-ae41-083fe4985b35", "relationship--1ca55789-ba43-595f-925c-5f457100f00c", "relationship--0ec90fd0-f62b-55e6-9e2f-b24f00218bc4", "relationship--4080d283-e9c7-58aa-b78a-95df304eae53", "relationship--a39200b5-2ef2-5a76-a4a1-f1bd75171276", "relationship--de87162f-0ac9-5d7a-a1fd-d0f1c8256dca", "relationship--13d0445b-668f-5b38-8374-7de38602a4c8", "relationship--e79c3a76-0f58-5c9b-8cf8-3bd72bb9fbe4", "relationship--4460fdc5-78f3-5c6c-afb1-481e12a713c7", "relationship--5a8e848e-5be8-576b-b5a3-8d65300d34e6", "relationship--3c3e4418-7946-5778-b3f1-6987885d13b8", "relationship--6870f799-aaec-5d9b-a08d-50c9f36a7ee7", "relationship--e9f0ce4f-14ba-5c82-a475-1ff30a18804e", "relationship--29949733-8a39-5bd5-b0e2-c165e998845b", "relationship--1222cdc7-72c2-5391-a02e-0a71c999484a", "relationship--a84a83ac-ad30-53d3-9e4c-a49991217a56", "relationship--25d5764c-bd20-5958-8d37-e7adfb95d0f8", "relationship--a66d2b73-7a8c-5554-ac07-fc908ddd118c", "relationship--74650b70-3b41-5ead-b9ff-734f4a1274af", "relationship--f115835d-0c59-53ce-9d52-4af2cf331d12", "relationship--b5029737-73f4-5366-aa56-32c92dcccae1", "relationship--ef201b69-e915-5fed-b9cf-7ecce4bcbf39", "relationship--cb33325d-6758-58ba-8efe-8fa991bc5db9", "relationship--80e8b3f4-45ae-5878-aaea-be4c5315b766", "relationship--e677d062-b2c4-5ed8-b7c8-a256bc4e2ba6", "relationship--cb9fd373-3b6f-57d1-be1b-2bf3246af8ff", "relationship--a1a6afa0-9594-5de3-a77f-ef8f2c28ff3d", "relationship--7b0e3d95-d280-5fe7-b839-969e44f752a5", "relationship--d011025d-7fc6-5eb7-9b24-7dfc788ca498", "relationship--7dfb4e33-9b6b-5d94-90d3-46936f3fd6c5", "relationship--227efb4f-c326-5369-bc2d-e001949177f1", "relationship--3fa17363-2e88-5f47-841c-670e25f9f494", "relationship--418a9719-c2f3-5f86-b9f3-25b7cb238851", "relationship--2ec77739-f09d-5ab0-8d80-90686c732405", "relationship--e00eee00-fa1b-58ac-8e1e-06e60a9ab385", "relationship--f156b70a-1c36-57ef-add3-bf4f29e6e526", "relationship--f98b3a17-fea0-5b2b-a66c-57280901ee9a", "relationship--7f47693c-8e56-52e8-80e2-27a1b6f4014e", "relationship--a0d859e9-e660-5391-b6b3-1a0634ea055f", "relationship--455d812e-73e5-5657-b779-a90d342f1183", "relationship--dd2773ac-06af-5878-9a60-b126195191c3", "relationship--a3e22d75-2d7b-5cf2-ad4a-e8f67ca59b89", "relationship--0d58bdb3-cb1c-569f-9c3e-7f4513263024", "relationship--3b9bac38-df8a-5a09-a00f-a889ae8bf300", "relationship--730a311a-7125-5bff-936f-f4f29c145cd3", "relationship--a57eea08-198b-557f-ac5e-8287afb60fb5", "relationship--def42d8d-fcc4-522c-aac6-1d7185e23336", "relationship--79baa295-a7b9-5fb2-a7ee-67efca518d01", "relationship--1dd96872-2f36-568c-ac58-a2dbb8512530", "relationship--8b9b1b12-b589-5866-8332-721cb82c1ce7", "relationship--e015231c-3e86-5ee2-b351-3f7faeac301c", "relationship--db454347-53b4-550a-b237-78efe81d399e", "relationship--67c3dce6-6c6b-5fce-8b2a-1d81319d23ee", "relationship--0a01acb2-8d1f-5b83-b42e-4b54b6fa4f8a", "relationship--72497efc-5e5c-5472-ad7d-06a8273c974a", "relationship--064f3210-91cf-5b38-8fcf-99a8529bfaf1", "relationship--aa9c3205-fa43-5f9d-a7aa-99b14732899e", "relationship--b86a0163-774c-5834-afd5-660b582b7d5a", "relationship--25d179bf-606c-5d76-8976-8a176f3dcffe", "relationship--7c8ea2a7-9c60-594f-baf6-6d214fd8ee27", "relationship--f9a256f7-75c7-5463-a903-e6acd04f2c2f", "relationship--166960a7-e2e5-58a6-a1ff-63cdade630d2", "relationship--885c672c-53e4-5a51-96b2-0a4abd559ec5", "relationship--a3828b39-2b58-5b34-815e-ad4cc4358b79", "relationship--00101c8a-4a88-5399-8b9a-3facfdaa9688", "relationship--f6c73e71-bc65-5687-9e3a-83b8ffa9910f", "relationship--fc29cf1b-cdd6-57fa-b3f2-9b3da5ebfa14", "relationship--b06d2e4d-9459-5438-9177-ab8c973d400d", "relationship--ab51f7f0-ddfd-580b-ac9e-a7fa0f3a3d4c", "relationship--cb709231-8d5b-5cbf-beac-cd47c802036e", "relationship--36bcdbcb-355f-56e2-b994-e347dabf0e51", "relationship--0bfd029b-03b4-5702-8f44-1720f1ce13e3", "relationship--6d0d504e-9c75-51f4-abf0-1746ad6fdaf4", "relationship--3a839d29-6fda-57a8-8344-5df69293d561", "relationship--6ef2cd26-5059-5278-aef0-d59e32878000", "relationship--fb30ccc2-1545-546a-a462-146e013b959e", "relationship--0b47b8e1-21b7-5961-a55b-2f8af5ad6b38", "relationship--31a9883c-dd90-5567-995d-18b9b38414bf", "relationship--43f5843d-a985-5144-b023-545b729db93b", "relationship--1db5275d-0111-5f35-b855-571b3979aaef", "relationship--a4c30161-bce0-5e3b-940b-7cef8197713c", "relationship--77273ecd-739c-5194-8ed2-e443b0578bd3", "relationship--2ab1f6a5-7e29-553d-b811-b35675e8be6b", "relationship--93f43e41-0d13-5d25-8484-6a89f428b661", "relationship--91afb86f-b350-51c3-9dd2-0855fdabe594", "relationship--65ec254e-9db0-5ef2-9349-a06f5e511af3", "relationship--e907080b-8d9d-54f3-8955-7334fe176208", "relationship--2b3cf33d-d2bf-5829-8c8b-255220b972b2", "relationship--0b8e434e-7be8-5e70-9ede-70e074a6d8b8", "relationship--34142e4f-4d8e-54db-8389-09c81a6e6fdc", "relationship--ece71e8f-61b2-56f8-9964-6e93b3c7c92c", "relationship--d3689544-6274-549b-87df-3394dc89f889", "relationship--56778e48-083e-55bd-b623-b6906bd6b368", "relationship--be5605d4-b85c-5fef-bb06-2a22e90c0e34", "relationship--b54efe90-e5bc-5352-817e-0928af5eeadf", "relationship--7c18982d-2f61-568d-863d-a98a66b3769b", "relationship--bac578d1-df9f-52f1-a638-1cb2f272b3a9", "relationship--e9521116-e12f-5035-b281-55e220cc824b", "relationship--1b7b1e0b-4c8e-5c69-bbf0-bd8cf1e3eb1e", "relationship--f8560cb7-3a5a-5a47-befb-0d4d022a544a", "relationship--18564e17-6ae7-5934-af8e-b2b9dc2582bd", "relationship--aef1632c-1133-5890-b110-16e3dd7d10b1", "relationship--223c4364-efd0-52ab-b414-97b899cd9156", "relationship--73b7939d-23ec-5a5c-9054-e4999eaf8950", "relationship--ad7559ad-7574-562f-8e7e-8710953bb311", "relationship--9d66e640-0d64-5013-a627-0e0268d48e30", "relationship--89c15d03-f72c-50de-8c66-5c926dd257cf", "relationship--54114cee-cd95-5bd7-a2fd-ad6100fa4900", "relationship--d11ab1e2-2573-5049-84e0-b3480dad9045", "relationship--b02a8d18-2a47-54bf-87fd-9509da66adaf", "relationship--9c76cc1e-28fb-5024-bf95-0a9f48dd46fc", "relationship--fa047e80-6b67-552a-8b10-36c4bcb36817", "relationship--70385826-323e-5d51-9132-a0125a9760b3", "relationship--32d50c01-a1f1-55be-a7b9-5d5c5b0bd57c", "relationship--5a58d380-cee0-5a42-b75d-3bee58276477", "relationship--252232af-f1a8-5bac-a474-365d5e587683", "relationship--fb7ea418-638c-5fa8-8ddf-a78649405480" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/flaskc2-postex-toolkit-67-215-232-25/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }