{ "type": "bundle", "id": "bundle--5a4dba95-0669-423c-b458-44e82c51c6a2", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.347163Z", "modified": "2026-06-14T11:56:08.347163Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--e35990fa-a64b-54ec-94be-6b82c22af8b3", "value": "172.105.0.126" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9427c028-4d29-5459-8d42-9d771bbc8bd1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.34765Z", "modified": "2026-06-14T11:56:08.34765Z", "name": "ipv4: 172.105.0.126", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.105.0.126']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--3fe8b1e3-8297-594e-98e0-7fce2cc1a53b", "value": "http://172.105.0.126/au2U" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--428a11c7-2bcb-540b-8df9-962641058d5a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.349877Z", "modified": "2026-06-14T11:56:08.349877Z", "name": "url: http://172.105.0.126/au2U", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126/au2U']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--ca7f35f0-8f63-5a62-bf5b-ce1f5d9f77cc", "value": "http://172.105.0.126/msI4" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c1667ac-7b21-5a78-9ded-03b9f0ab6691", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.350388Z", "modified": "2026-06-14T11:56:08.350388Z", "name": "url: http://172.105.0.126/msI4", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126/msI4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--da6b8ff5-59f5-5e97-9d9d-1250c699ffe7", "value": "http://172.105.0.126/en_US/all.js" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e361716-0124-58f9-8613-022b36caec8f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.350948Z", "modified": "2026-06-14T11:56:08.350948Z", "name": "url: http://172.105.0.126/en_US/all.js", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126/en_US/all.js']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--53225cca-1b1e-5760-92a8-258635ea795c", "value": "http://172.105.0.126/submit.php" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--383e524d-b826-5cf1-86e6-8b44f975f8fb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.351654Z", "modified": "2026-06-14T11:56:08.351654Z", "name": "url: http://172.105.0.126/submit.php", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126/submit.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--390e3578-f50e-5513-9f5c-58b263d6a83a", "value": "http://172.105.0.126/ga.js" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b79cec8e-751f-5739-9bb2-451b58f50516", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.352213Z", "modified": "2026-06-14T11:56:08.352213Z", "name": "url: http://172.105.0.126/ga.js", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126/ga.js']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--d36f8741-4637-547d-9880-a79181dcf221", "value": "http://172.105.0.126:809/ga.js" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d1c94d24-f95d-5089-ad5a-0395357ce5e4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.352974Z", "modified": "2026-06-14T11:56:08.352974Z", "name": "url: http://172.105.0.126:809/ga.js", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://172.105.0.126:809/ga.js']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-08T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "file", "spec_version": "2.1", "id": "file--18955408-a8e9-58be-8839-c3945fd7cb41", "hashes": { "SHA-256": "042761408e83155d24884a72291d9f10803becd790fbcfa6ff65e9e72eb44446" } }, { "type": "file", "spec_version": "2.1", "id": "file--9a23d80e-9664-5030-bb5c-f2adc9030260", "hashes": { "SHA-256": "03492f128fcc3910bda15f393c30ad3e04f5a50de36464d1e24038f49d889324" } }, { "type": "file", "spec_version": "2.1", "id": "file--2b4a6ccb-289b-5e9f-8857-f19fc9df42b7", "hashes": { "SHA-256": "9bdb680d4368713273509e8c104c1903b9790ee725cc2319997e1da705af5ca0" } }, { "type": "file", "spec_version": "2.1", "id": "file--c61b2070-a015-541d-8923-ec3e75939744", "hashes": { "SHA-256": "0d050b35abaa2a47340ec925727b0d508605733676552dbc94080c2da9f863d2" } }, { "type": "file", "spec_version": "2.1", "id": "file--4d6b1c23-bd58-5afa-9b70-fc74dedd1bb8", "hashes": { "SHA-256": "3b2d746d0974bb5ffec7d21b47d793fb1eef2af930d639b2f494cbe900fe0c3e" } }, { "type": "file", "spec_version": "2.1", "id": "file--4ece9763-201b-59d0-8bb9-c714f16ddbd4", "hashes": { "SHA-256": "ad1fc7f801bd2166edeeeb5f97fa087bb1769cde57e500a7c0eb2a844e3ad95f" } }, { "type": "file", "spec_version": "2.1", "id": "file--61f4103d-afb1-5673-8456-9514b64bbfc2", "hashes": { "SHA-256": "af688b120db0a3b324e2cd468cfead71b7895a3c815f4026d51ac7fca0cb8ab4" } }, { "type": "file", "spec_version": "2.1", "id": "file--6875b98c-35ce-56c2-831b-61b9efa37add", "hashes": { "SHA-256": "701b4f60411a26abfb137f476c9328900843ee5a49780f2fcd23a5cb15498f16" } }, { "type": "file", "spec_version": "2.1", "id": "file--beb6ec3d-6a54-52b7-8407-847607a50cb5", "hashes": { "SHA-256": "6797ba96336c64648d6bcccdbead8d9ab6f18d77f0108239e31a063b32665770" } }, { "type": "file", "spec_version": "2.1", "id": "file--a68c6c6d-c7eb-53e7-9739-627d0fa0216d", "hashes": { "SHA-256": "820cf45c92b9cce9536ad108fc4b8c1c501bb6f4e30119b1bef0486670de02e4" } }, { "type": "file", "spec_version": "2.1", "id": "file--9d7a92ea-ff5d-51b5-be15-b536e2a4435a", "hashes": { "SHA-256": "89ec81f862be889f6e8bfbad7c3c39410a9039467f1fdfe8752f64a59e113d10" } }, { "type": "file", "spec_version": "2.1", "id": "file--73404bf3-fb6b-5fcb-9f85-36f5a14d4467", "hashes": { "SHA-256": "04720e01f0599ff97d85f74d1483245c59353bb5ea391f2c4c9cb6ce4ef46d35" } }, { "type": "file", "spec_version": "2.1", "id": "file--09af6f20-cfc3-5070-ace6-21c987087ae7", "hashes": { "SHA-256": "f0fc7d3b3f7b2fa10b796102889a44d57a7ad403d2038bada3c0fbd983d13c81" } }, { "type": "file", "spec_version": "2.1", "id": "file--c3c883ce-419d-583e-8e9f-7160c274f3e1", "hashes": { "SHA-256": "7c643568b3212363cd97511f2607ad2481b9f3b6f6a829999df469af7c0184b7" } }, { "type": "file", "spec_version": "2.1", "id": "file--5543d6b7-20a3-5822-8010-70158fc5aa17", "hashes": { "SHA-256": "b0f0fe97b653e4564db8cf24cbd4cc2cad46f9c6629b67c2f147e647729f5b46" } }, { "type": "file", "spec_version": "2.1", "id": "file--d8667f4d-4884-52d7-b91a-073fc4aa13c1", "hashes": { "SHA-256": "8ab7e87b34d65393618fabd5b48017d803e795064d4a290128c3eea1e54742f0" } }, { "type": "file", "spec_version": "2.1", "id": "file--31ff33f7-909f-5e3a-bd82-c4604b535a60", "hashes": { "SHA-256": "86b581e40a9ff912683b6f3579d155a8d765669acbba10d400abce451a898be5" } }, { "type": "file", "spec_version": "2.1", "id": "file--0af3acc6-c965-57e5-82b0-55d2ebf3df70", "hashes": { "SHA-256": "f618c8073bbc18f36ebf522aa15e680bf63e867b115c27ab1546c2326507917b" } }, { "type": "file", "spec_version": "2.1", "id": "file--34c1c23e-bd3d-588b-9b52-80fdf5ca4707", "hashes": { "SHA-256": "46a74c19bc3fecb149c452c286b912999a43e7808194a55ede4d9a19e56f4081" } }, { "type": "file", "spec_version": "2.1", "id": "file--eb2a64d4-c0cc-5321-84b5-e91ebab86eac", "hashes": { "SHA-256": "5c65b88fe12e6116d917e0a04ca57c4d3784d283a350d9e3dcec2691fe7eff2c" } }, { "type": "file", "spec_version": "2.1", "id": "file--5ff4580e-100e-5c51-b585-45fdf008f8df", "hashes": { "SHA-256": "5dad2214471215e262910e9dcb348cf42c62fc8d8b26a85c8e959d5f1ce78c80" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4cd733d-3951-597f-b881-411af8cc6ab4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.358936Z", "modified": "2026-06-14T11:56:08.358936Z", "name": "TOOLKIT_OpenStrike_Gen4_Beacon", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Name: OpenStrike Gen-4 Beacon (beacon_windows_x64.exe)\n Author: The Hunters Ledger\n Date: 2026-04-08\n Identifier: OpenStrike Generation 4 WinHTTP beacon with SHA256 key derivation\n Reference: https://the-hunters-ledger.com/reports/new-files-found-20260408/\n License: https://creativecommons.org/licenses/by-nc/4.0/\n*/\n\nrule TOOLKIT_OpenStrike_Gen4_Beacon\n{\n meta:\n description = \"Detects OpenStrike Generation 4 beacon (beacon_windows_x64.exe) by WinHTTP task-poll and output-submit URI format strings containing 8-hex-digit beacon IDs, the shared AES-128-CBC static IV, and the GCC 15.2.0 MinGW build artifact. Gen-4 is 10x smaller than gen-3 (30KB vs 299KB) with a correct Encrypt-then-MAC architecture and SHA256-based key derivation, though key exchange is absent confirming it is a development artifact.\"\n author = \"The Hunters Ledger\"\n date = \"2026-04-08\"\n hash_sha256 = \"042761408e83155d24884a72291d9f10803becd790fbcfa6ff65e9e72eb44446\"\n reference = \"https://the-hunters-ledger.com/reports/new-files-found-20260408/\"\n family = \"OpenStrike\"\n\n strings:\n $s1 = \"/updates?id=%08x\" ascii\n $s2 = \"/submit?id=%08x\" ascii\n $s3 = \"abcdefghijklmnop\" ascii\n $s4 = \"ChainingModeCBC\" ascii\n $s5 = \"cmd.exe /c %.*s\" ascii\n $s6 = \"[*] OpenStrike Beacon starting...\" ascii\n $s7 = \"GCC: (GNU) 15.2.0\" ascii\n\n condition:\n uint16(0) == 0x5A4D and\n filesize < 102400 and\n ($s6 or ($s1 and $s2)) and\n ($s3 or $s4 or $s7 or $s5)\n}", "pattern_type": "yara", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26ed5ec3-103a-57ab-bd6b-3e7f35c0dd45", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.35931Z", "modified": "2026-06-14T11:56:08.35931Z", "name": "TOOLKIT_OpenStrike_Proto_Beacons", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Name: OpenStrike Gen-1/Gen-2 Prototype Beacons\n Author: The Hunters Ledger\n Date: 2026-04-08\n Identifier: OpenStrike mini_beacon (gen-1) and mini_beacon2 (gen-2) prototypes\n Reference: https://the-hunters-ledger.com/reports/new-files-found-20260408/\n License: https://creativecommons.org/licenses/by-nc/4.0/\n*/\n\nrule TOOLKIT_OpenStrike_Proto_Beacons\n{\n meta:\n description = \"Detects OpenStrike Generation 1 (mini_beacon.exe) and Generation 2 (mini_beacon2.exe) prototype beacons. Gen-1 uses Cookie: SESSIONID=%d format for C2 host identification with no cryptography. Gen-2 adds RSA-1024 BCrypt CNG registration with a binary magic header (0xEFBE0000 big-endian) and host fingerprinting including process name masquerade as svchost.exe. The RSA-1024 modulus prefix is shared with the CS 4.4 Key B ecosystem.\"\n author = \"The Hunters Ledger\"\n date = \"2026-04-08\"\n hash_sha256 = \"03492f128fcc3910bda15f393c30ad3e04f5a50de36464d1e24038f49d889324\"\n reference = \"https://the-hunters-ledger.com/reports/new-files-found-20260408/\"\n family = \"OpenStrike\"\n\n strings:\n $s1 = \"Cookie: SESSIONID=%d\" ascii\n $b1 = { 00 00 BE EF }\n $s2 = \"008cadd72dbf3cc108\" ascii\n $s3 = \"GCC: (GNU) 15-win32\" ascii\n\n condition:\n uint16(0) == 0x5A4D and\n filesize < 102400 and\n ($s1 or $b1 or $s2) and\n $s3\n}", "pattern_type": "yara", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c189155-13aa-51fa-a346-78c523b828aa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.359554Z", "modified": "2026-06-14T11:56:08.359554Z", "name": "MALW_ArtifactKit_EAXRedirect_Svc", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Name: Cobalt Strike Artifact Kit EAX-Redirect Service Variant\n Author: The Hunters Ledger\n Date: 2026-04-08\n Identifier: artifact32svc.exe / artifact64svc.exe \u2014 EAX-redirect process hollowing\n Reference: https://the-hunters-ledger.com/reports/new-files-found-20260408/\n License: https://creativecommons.org/licenses/by-nc/4.0/\n*/\n\nrule MALW_ArtifactKit_EAXRedirect_Svc\n{\n meta:\n description = \"Detects Cobalt Strike Artifact Kit service variant (artifact32svc.exe/artifact64svc.exe) that registers as the DceRpcSs service, creates a named pipe matching MSSE-[0-9]+-server for XOR-encoded shellcode delivery, and performs EAX-redirect thread hijacking of a suspended rundll32.exe process. Unlike classic process hollowing, this variant never calls NtUnmapViewOfSection \u2014 detection must anchor on SetThreadContext called on suspended threads, or on this binary's static strings.\"\n author = \"The Hunters Ledger\"\n date = \"2026-04-08\"\n hash_sha256 = \"701b4f60411a26abfb137f476c9328900843ee5a49780f2fcd23a5cb15498f16\"\n reference = \"https://the-hunters-ledger.com/reports/new-files-found-20260408/\"\n family = \"CobaltStrike\"\n\n strings:\n $s1 = \"DceRpcSs\" ascii\n $s2 = \"\\\\\\\\.\\\\pipe\\\\MSSE-%d-server\" ascii\n $s3 = \"rundll32.exe\" ascii\n\n condition:\n uint16(0) == 0x5A4D and\n filesize < 819200 and\n $s1 and $s2 and $s3\n}", "pattern_type": "yara", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74b54f02-d2c0-56e3-a1fd-46cce635852e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.359788Z", "modified": "2026-06-14T11:56:08.359788Z", "name": "MALW_CovertVPN_L2Bridge", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Name: CovertVPN Layer 2 Bridge Module\n Author: The Hunters Ledger\n Date: 2026-04-08\n Identifier: covertvpn.dll \u2014 CS CovertVPN L2 bridge with embedded WinPcap stack\n Reference: https://the-hunters-ledger.com/reports/new-files-found-20260408/\n License: https://creativecommons.org/licenses/by-nc/4.0/\n*/\n\nrule MALW_CovertVPN_L2Bridge\n{\n meta:\n description = \"Detects the Cobalt Strike CovertVPN Layer 2 bridge module (covertvpn.dll) by its unpatched 32-character AES key config placeholder (AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH), self-contained WinPcap 4.1.3 deployment strings (npf.sys, wpcap.dll), and HTTP data channel URI (/receive%s). The module embeds npf.sys as a kernel driver in its .data section (~556KB) and supports 5 transport channels: TCP connect/bind, UDP, HTTP, and ICMP echo with 0xDD/0xCC frame markers.\"\n author = \"The Hunters Ledger\"\n date = \"2026-04-08\"\n hash_sha256 = \"af688b120db0a3b324e2cd468cfead71b7895a3c815f4026d51ac7fca0cb8ab4\"\n reference = \"https://the-hunters-ledger.com/reports/new-files-found-20260408/\"\n family = \"CovertVPN\"\n\n strings:\n $s1 = \"AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH\" ascii\n $s2 = \"npf.sys\" ascii\n $s3 = \"wpcap.dll\" ascii\n $s4 = \"/receive%s\" ascii\n\n condition:\n uint16(0) == 0x5A4D and\n filesize < 2097152 and\n $s1 and\n ($s2 or $s3 or $s4)\n}", "pattern_type": "yara", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--045b71ab-f085-5ffe-bf22-f9ccfc9e2443", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.360014Z", "modified": "2026-06-14T11:56:08.360014Z", "name": "TOOLKIT_OpenStrike_DllLoader", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Name: OpenStrike DLL Loader (dll_loader.exe)\n Author: The Hunters Ledger\n Date: 2026-04-08\n Identifier: OpenStrike dll_loader.exe \u2014 disk-drop LoadLibraryA outlier loader\n Reference: https://the-hunters-ledger.com/reports/new-files-found-20260408/\n License: https://creativecommons.org/licenses/by-nc/4.0/\n*/\n\nrule TOOLKIT_OpenStrike_DllLoader\n{\n meta:\n description = \"Detects OpenStrike dll_loader.exe, a custom loader that loads a Cobalt Strike beacon DLL from the hardcoded path C:\\\\Windows\\\\Temp\\\\beacon.dll using LoadLibraryA, then enters an infinite Sleep(60000) keepalive loop. Unlike the five in-memory loader variants from the same GCC 15 codebase, this loader drops payload to disk rather than allocating RWX memory. Identified by the hardcoded path, operator diagnostic format strings, and GCC 15-win32 MinGW build artifact.\"\n author = \"The Hunters Ledger\"\n date = \"2026-04-08\"\n hash_sha256 = \"820cf45c92b9cce9536ad108fc4b8c1c501bb6f4e30119b1bef0486670de02e4\"\n reference = \"https://the-hunters-ledger.com/reports/new-files-found-20260408/\"\n family = \"OpenStrike\"\n\n strings:\n $s1 = \"C:\\\\Windows\\\\Temp\\\\beacon.dll\" ascii\n $s2 = \"DLL loaded at %p\" ascii\n $s3 = \"LoadLibrary failed: %lu\" ascii\n $s4 = \"GCC: (GNU) 15-win32\" ascii\n\n condition:\n uint16(0) == 0x5A4D and\n filesize < 204800 and\n $s1 and\n ($s2 or $s3) and\n $s4\n}", "pattern_type": "yara", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--63782934-9c11-58a9-9052-d00e1eb82002", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.360215Z", "modified": "2026-06-14T11:56:08.360215Z", "name": "Artifact Kit EAX-Redirect Process Hollowing via Rundll32 No Arguments", "indicator_types": [ "malicious-activity" ], "pattern": "title: Artifact Kit EAX-Redirect Process Hollowing via Rundll32 No Arguments\nid: a4f82c19-7b3e-4d56-9e1a-2c5f8b0d3e74\nstatus: experimental\ndescription: Detects the Cobalt Strike Artifact Kit service variant EAX-redirect process hollowing pattern where a Windows service process (services.exe parent) spawns rundll32.exe with no command-line arguments. The Artifact Kit then performs VirtualAllocEx, WriteProcessMemory, and SetThreadContext on the suspended rundll32.exe to redirect execution to shellcode via the EAX register. This technique bypasses NtUnmapViewOfSection-anchored classic process hollowing detection because the original PE is never unmapped.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\services.exe'\n Image|endswith: '\\rundll32.exe'\n filter_has_args:\n CommandLine|contains: ' '\n condition: selection and not filter_has_args\nfalsepositives:\n - Legitimate Windows services that invoke rundll32.exe without arguments (extremely rare; verify by examining the parent service binary path and cross-referencing against asset inventory)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--71a24fb1-5cb8-51ab-94d4-9ca439d8a824", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.360418Z", "modified": "2026-06-14T11:56:08.360418Z", "name": "Cobalt Strike Artifact Kit MSSE Named Pipe Creation", "indicator_types": [ "malicious-activity" ], "pattern": "title: Cobalt Strike Artifact Kit MSSE Named Pipe Creation\nid: b7c91d3e-5a20-4f88-b2d4-8e1c9a4f6b52\nstatus: experimental\ndescription: Detects creation of the Cobalt Strike Artifact Kit default named pipe pattern MSSE-[number]-server. The Artifact Kit service variant (artifact32svc/artifact64svc) creates this pipe to transfer XOR-encoded shellcode to the hollowing target via kernel pipe indirection as an AV evasion technique. The pipe ID is derived from GetTickCount() modulo 9898, producing values in the range 0 to 9897. No legitimate Windows component creates pipes with this naming pattern.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.defense-evasion\nlogsource:\n category: pipe_created\n product: windows\ndetection:\n selection:\n PipeName|startswith: '\\MSSE-'\n PipeName|endswith: '-server'\n condition: selection\nfalsepositives:\n - None known \u2014 MSSE-[0-9]+-server pipe naming is specific to the Cobalt Strike Artifact Kit default configuration; no legitimate Windows component uses this pattern\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--60fc3b33-a6c4-5b4f-bd2c-07d5c7967a1c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36067Z", "modified": "2026-06-14T11:56:08.36067Z", "name": "DceRpcSs Masquerading Service Installation", "indicator_types": [ "malicious-activity" ], "pattern": "title: DceRpcSs Masquerading Service Installation\nid: c3d84e7f-2b61-4a99-8f3c-5d7e1b8c2a96\nstatus: experimental\ndescription: Detects installation of a Windows service named DceRpcSs, which masquerades as the legitimate RpcSs (Remote Procedure Call) service. The Cobalt Strike Artifact Kit service variant registers under this name to blend with built-in Windows services and survive casual administrative review. The legitimate RpcSs service name does not match DceRpcSs in any Windows version. Any Event ID 7045 with this service name is a high-confidence incident indicator.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.persistence\n - attack.defense-evasion\nlogsource:\n product: windows\n service: system\ndetection:\n selection:\n EventID: 7045\n ServiceName: 'DceRpcSs'\n condition: selection\nfalsepositives:\n - None known \u2014 DceRpcSs is not a legitimate Windows service name; any match should be treated as a high-confidence incident indicator requiring immediate investigation\nlevel: critical", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ccf74ab8-506d-5e0f-899d-9f285ebd6cd7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.360891Z", "modified": "2026-06-14T11:56:08.360891Z", "name": "CovertVPN WinPcap npf.sys Kernel Driver Loaded from Temp Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: CovertVPN WinPcap npf.sys Kernel Driver Loaded from Temp Directory\nid: d9e05a82-6c34-4b77-a1f5-3e8d2c7b4f01\nstatus: experimental\ndescription: Detects loading of the npf.sys WinPcap kernel driver from a user temporary directory. The Cobalt Strike CovertVPN Layer 2 bridge module embeds WinPcap 4.1.3 components (npf.sys x86 and amd64, wpcap.dll, Packet.dll) in its .data section and installs npf.sys as a kernel driver service from %TEMP% to enable raw packet capture for its ICMP and UDP transport channels. Legitimate WinPcap and Npcap installations place the driver in System32\\drivers, not in user temp directories.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.persistence\n - attack.command-and-control\nlogsource:\n category: driver_load\n product: windows\ndetection:\n selection:\n ImageLoaded|endswith: '\\npf.sys'\n filter_legitimate:\n ImageLoaded|contains:\n - '\\System32\\drivers\\'\n - '\\SysWOW64\\drivers\\'\n condition: selection and not filter_legitimate\nfalsepositives:\n - Legitimate WinPcap or Npcap installers that stage npf.sys in a temporary directory before moving it to System32\\drivers (uncommon; verify by checking for a subsequent persistent driver installation in System32\\drivers)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2927071d-b679-54b5-94f9-0195ec568fa8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.361119Z", "modified": "2026-06-14T11:56:08.361119Z", "name": "Cobalt Strike Beacon DLL Dropped to Windows Temp Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: Cobalt Strike Beacon DLL Dropped to Windows Temp Directory\nid: e1f73b45-8d92-4c66-b3e7-4a9f5d1c8b27\nstatus: experimental\ndescription: Detects creation of a file named beacon.dll in C:\\Windows\\Temp, the hardcoded drop path used by OpenStrike dll_loader.exe. The loader uses LoadLibraryA to load the Cobalt Strike beacon DLL from this exact path and then enters an infinite Sleep(60000) keepalive loop. Writing a payload named beacon.dll to this system-writable directory is a high-confidence indicator of dll_loader.exe staging activity or direct operator file placement.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.defense-evasion\n - attack.execution\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename: 'C:\\Windows\\Temp\\beacon.dll'\n condition: selection\nfalsepositives:\n - None known \u2014 the filename beacon.dll at this exact path is not used by any known legitimate software; any match should be treated as a high-confidence incident indicator\nlevel: critical", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bb397b36-f476-5323-898f-5410ee954cb5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.361389Z", "modified": "2026-06-14T11:56:08.361389Z", "name": "Cobalt Strike Malleable C2 BOIE9 IE9 User-Agent in Proxy Traffic", "indicator_types": [ "malicious-activity" ], "pattern": "title: Cobalt Strike Malleable C2 BOIE9 IE9 User-Agent in Proxy Traffic\nid: f4a82d61-3c57-4e88-9b2f-5e1a7c8d3f49\nstatus: experimental\ndescription: Detects the Cobalt Strike beacon80.dll Malleable C2 profile User-Agent containing the BOIE9;ENUSSEM suffix. The full user-agent string is Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM). This non-standard suffix is injected by the Malleable C2 profile configuration and does not appear in genuine Internet Explorer 9 browser traffic. This profile is distinct from the MALC-suffix profile covered in the companion April 6 detection file.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.command-and-control\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-user-agent|contains: 'BOIE9;ENUSSEM'\n condition: selection\nfalsepositives:\n - None known \u2014 BOIE9;ENUSSEM does not appear in any known legitimate browser or application user-agent string\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d0cb93b-cf51-527e-862e-2e3b237b094a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.361693Z", "modified": "2026-06-14T11:56:08.361693Z", "name": "OpenStrike Gen-4 Beacon Task Polling HTTP GET to /updates with Hex Beacon ID", "indicator_types": [ "malicious-activity" ], "pattern": "title: OpenStrike Gen-4 Beacon Task Polling HTTP GET to /updates with Hex Beacon ID\nid: a8c35f72-4d19-4b83-9e6a-1c7d5e2b8f30\nstatus: experimental\ndescription: Detects the OpenStrike Generation 4 beacon (beacon_windows_x64.exe) task polling pattern \u2014 HTTP GET requests to /updates with an 8-character lowercase hex beacon ID query parameter. The beacon ID is a djb2 hash variant (multiplier 0x1f) of ComputerName XOR'd with PID, making it deterministic per host across process restarts. The beaconing interval is approximately 5 seconds with 10 percent jitter (4500\u20135500ms base). Correlate with corresponding POST to /submit?id=[same ID] for high-confidence identification.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.command-and-control\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-method: 'GET'\n c-uri|re: '^/updates\\?id=[0-9a-f]{8}$'\n condition: selection\nfalsepositives:\n - Web applications using /updates as an API endpoint with an id parameter of exactly 8 lowercase hex characters (uncommon in enterprise environments; verify against known application inventory and look for correlated POST to /submit?id=)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c550b0c-4a26-5a49-8cfe-9f0b6b81eb28", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36193Z", "modified": "2026-06-14T11:56:08.36193Z", "name": "OpenStrike Gen-4 Beacon Output Submission HTTP POST to /submit with Hex Beacon ID", "indicator_types": [ "malicious-activity" ], "pattern": "title: OpenStrike Gen-4 Beacon Output Submission HTTP POST to /submit with Hex Beacon ID\nid: b2e49c83-5f61-4a77-9d3e-2b8c1a4f7e52\nstatus: experimental\ndescription: Detects the OpenStrike Generation 4 beacon output submission pattern \u2014 HTTP POST to /submit with an 8-character lowercase hex beacon ID query parameter. Command output is AES-128-CBC encrypted with PKCS7 padding, then a 16-byte truncated HMAC-SHA256 tag is appended (Encrypt-then-MAC). The beacon ID matches the corresponding GET to /updates?id=[same ID]. Correlating matched pairs of GET /updates and POST /submit with the same 8-hex-digit ID provides high-confidence identification of an active gen-4 beacon session.\nreferences:\n - https://the-hunters-ledger.com/reports/new-files-found-20260408/\nauthor: The Hunters Ledger\ndate: 2026/04/08\ntags:\n - attack.exfiltration\n - attack.command-and-control\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-method: 'POST'\n c-uri|re: '^/submit\\?id=[0-9a-f]{8}$'\n condition: selection\nfalsepositives:\n - API endpoints using /submit with an id parameter of exactly 8 hex characters accepting POST data (uncommon in enterprise environments; correlate with matched GET to /updates?id= for the same ID to confirm)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7b8f40ae-5d52-51d6-83b3-eea661e6648a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362106Z", "modified": "2026-06-14T11:56:08.362106Z", "name": "THL OpenStrike Gen4 Beacon Task Poll GET /updates?id=[hex8]", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL OpenStrike Gen4 Beacon Task Poll GET /updates?id=[hex8]\"; flow:established,to_server; http.method; content:\"GET\"; http.uri; content:\"/updates?id=\"; pcre:\"/\\/updates\\?id=[0-9a-f]{8}$/U\"; threshold:type limit,track by_src,count 1,seconds 30; sid:9002001; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ccd48f1b-3b7e-506f-9685-dd6749f58f5b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362267Z", "modified": "2026-06-14T11:56:08.362267Z", "name": "THL OpenStrike Gen4 Beacon Output Submission POST /submit?id=[hex8]", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL OpenStrike Gen4 Beacon Output Submission POST /submit?id=[hex8]\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/submit?id=\"; pcre:\"/\\/submit\\?id=[0-9a-f]{8}$/U\"; threshold:type limit,track by_src,count 1,seconds 60; sid:9002002; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--de08bd9e-a1f9-5800-ae22-48e451d4158d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362424Z", "modified": "2026-06-14T11:56:08.362424Z", "name": "THL Cobalt Strike Malleable C2 BOIE9 IE9 User-Agent Detected", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL Cobalt Strike Malleable C2 BOIE9 IE9 User-Agent Detected\"; flow:established,to_server; http.user_agent; content:\"BOIE9;ENUSSEM)\"; endswith; nocase; sid:9002003; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cc37c9a6-e7f4-5892-b340-a85b839508ad", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362561Z", "modified": "2026-06-14T11:56:08.362561Z", "name": "THL Cobalt Strike Stager Download URI /au2U or /msI4 on Port 80", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> 172.105.0.126 80 (msg:\"THL Cobalt Strike Stager Download URI /au2U or /msI4 on Port 80\"; flow:established,to_server; http.method; content:\"GET\"; http.uri; pcre:\"/^\\/(?:au2U|msI4)$/U\"; sid:9002004; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Critical, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d53a318b-31c9-504b-8ee2-17538790a046", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362688Z", "modified": "2026-06-14T11:56:08.362688Z", "name": "THL CovertVPN HTTP Data Channel GET /receive Endpoint", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL CovertVPN HTTP Data Channel GET /receive Endpoint\"; flow:established,to_server; http.method; content:\"GET\"; http.uri; content:\"/receive\"; startswith; threshold:type limit,track by_src,count 3,seconds 60; sid:9002005; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--950fc351-f249-58c0-b6d6-a9eb851201a8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362813Z", "modified": "2026-06-14T11:56:08.362813Z", "name": "THL CovertVPN ICMP Tunnel Oversized Payload with Data or Keepalive Marker", "indicator_types": [ "malicious-activity" ], "pattern": "alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL CovertVPN ICMP Tunnel Oversized Payload with Data or Keepalive Marker\"; itype:8; dsize:>128; byte_test:1,=,0xDD,4; threshold:type limit,track by_src,count 5,seconds 60; sid:9002006; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_08, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_08;)", "pattern_type": "suricata", "valid_from": "2026-04-08T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.362985Z", "modified": "2026-06-14T11:56:08.362985Z", "name": "OpenStrike", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.363129Z", "modified": "2026-06-14T11:56:08.363129Z", "name": "Cobalt Strike 4.9.1", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.363285Z", "modified": "2026-06-14T11:56:08.363285Z", "name": "Cobalt Strike 4.4", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.363446Z", "modified": "2026-06-14T11:56:08.363446Z", "name": "Cobalt Strike 3.x", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--326ceb04-eb0d-586f-a71e-3730e7db79b2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.363693Z", "modified": "2026-06-14T11:56:08.363693Z", "name": "Gen-4 OpenStrike beacon \u2014 10 commands", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--ca728090-da45-570d-9856-f87b853ecb1a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.364311Z", "modified": "2026-06-14T11:56:08.364311Z", "name": "Gen-1 OpenStrike prototype \u2014 HTTP-only poller", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--60239ccb-9be2-5044-bf2f-221d17371925", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.364428Z", "modified": "2026-06-14T11:56:08.364428Z", "name": "Gen-2 OpenStrike \u2014 RSA-1024 registration", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--0936f583-379c-51f3-8973-fd3a5076487d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.364538Z", "modified": "2026-06-14T11:56:08.364538Z", "name": "CS 4.4 beacon DLL \u2014 RSA-1024", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--af99919f-6c3f-5c4f-86ee-3c02764d9697", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.364643Z", "modified": "2026-06-14T11:56:08.364643Z", "name": "CS 3.x beacon DLL \u2014 RSA-2048 Trinity key", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--7e96c5b8-376e-56e7-8081-b8139c662837", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36475Z", "modified": "2026-06-14T11:56:08.36475Z", "name": "CS 4.4 beacon DLL \u2014 Malleable C2 profile", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--0b0b1612-373b-5562-9c4b-f406a5ea857d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36486Z", "modified": "2026-06-14T11:56:08.36486Z", "name": "CovertVPN L2 bridge \u2014 ICMP tunnel", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--01b1db05-01b5-5ce2-b1b3-28b89ac42029", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.364979Z", "modified": "2026-06-14T11:56:08.364979Z", "name": "Artifact Kit service variant \u2014 EAX-redirect process hollowing", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--965066dd-5adb-55ef-a7a0-78729f9d6905", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365092Z", "modified": "2026-06-14T11:56:08.365092Z", "name": "x64 Artifact Kit service variant \u2014 mirrors artifact32svc hollowing pattern", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--c272f692-d503-5510-af2f-159eea0b2eac", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365201Z", "modified": "2026-06-14T11:56:08.365201Z", "name": "Custom CreateThread loader \u2014 download-mode beacon payload", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--57a1c9dc-aedc-5751-82ac-78759c2ca2a7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365326Z", "modified": "2026-06-14T11:56:08.365326Z", "name": "Custom CreateThread loader \u2014 full-feature beacon payload", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--0716f982-817b-5e0a-9ffb-813eeacc58e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365449Z", "modified": "2026-06-14T11:56:08.365449Z", "name": "Base shellcode indirect-call loader", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--1300b7be-3dc2-5428-a531-e77da8517561", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365579Z", "modified": "2026-06-14T11:56:08.365579Z", "name": "Hardcoded-offset RDI loader \u2014 call buf+0x1649c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--35a29184-2b1b-5dde-880d-e3fd5eb3a64f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365695Z", "modified": "2026-06-14T11:56:08.365695Z", "name": "sRDI v2 loader \u2014 same base loader as beacon_loader", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--b2db7b97-021e-5894-894d-be82ca1dd1d2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365824Z", "modified": "2026-06-14T11:56:08.365824Z", "name": "Disk-drop loader \u2014 LoadLibraryA", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--db35f68a-9203-5d1d-aa63-0133476d9c9e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.365944Z", "modified": "2026-06-14T11:56:08.365944Z", "name": "Simple LoadLibraryA", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--01c94219-dde7-56f5-8e23-4491926276db", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366056Z", "modified": "2026-06-14T11:56:08.366056Z", "name": "1KB PE stager \u2014 port 80", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--99ef2ac9-68bb-5fc8-9372-635d3c560d0f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366167Z", "modified": "2026-06-14T11:56:08.366167Z", "name": "PS1 stager wrapper \u2014 port 80", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--b9425ebd-6748-5fe8-8b5b-418322ef6ef8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36628Z", "modified": "2026-06-14T11:56:08.36628Z", "name": "Artifact-wrapped beacon \u2014 Trinity RSA-2048", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a2ee2e69-60d7-5975-9cff-ec7a8bc6e4ce", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366397Z", "modified": "2026-06-14T11:56:08.366397Z", "name": "Debug beacon config \u2014 port 809", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--77a4f5b6-3e70-5c96-be85-533c5982da09", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366527Z", "modified": "2026-06-14T11:56:08.366527Z", "name": "Sniffer beacon config \u2014 port 809", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--ec9845b4-4267-5bcf-a9ef-640cc8c5cec8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366647Z", "modified": "2026-06-14T11:56:08.366647Z", "name": ".NET execute-assembly test binary", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366767Z", "modified": "2026-06-14T11:56:08.366767Z", "name": "Develop Capabilities: Malware", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1587/001", "external_id": "T1587.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.366935Z", "modified": "2026-06-14T11:56:08.366935Z", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/001", "external_id": "T1059.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.367126Z", "modified": "2026-06-14T11:56:08.367126Z", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/003", "external_id": "T1059.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.367307Z", "modified": "2026-06-14T11:56:08.367307Z", "name": "JavaScript", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/007", "external_id": "T1059.007" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.367461Z", "modified": "2026-06-14T11:56:08.367461Z", "name": "Native API", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1106", "external_id": "T1106" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.367615Z", "modified": "2026-06-14T11:56:08.367615Z", "name": "Service Execution", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1569/002", "external_id": "T1569.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.367855Z", "modified": "2026-06-14T11:56:08.367855Z", "name": "Windows Service", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1543/003", "external_id": "T1543.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.368169Z", "modified": "2026-06-14T11:56:08.368169Z", "name": "PE Injection", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1055/002", "external_id": "T1055.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.368448Z", "modified": "2026-06-14T11:56:08.368448Z", "name": "Process Hollowing", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1055/012", "external_id": "T1055.012" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.36879Z", "modified": "2026-06-14T11:56:08.36879Z", "name": "Masquerade Task or Service", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1036/004", "external_id": "T1036.004" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.369162Z", "modified": "2026-06-14T11:56:08.369162Z", "name": "Match Legitimate Name or Location", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1036/005", "external_id": "T1036.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.369416Z", "modified": "2026-06-14T11:56:08.369416Z", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1027", "external_id": "T1027" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.369673Z", "modified": "2026-06-14T11:56:08.369673Z", "name": "Deobfuscate/Decode Files or Information", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1140", "external_id": "T1140" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.369935Z", "modified": "2026-06-14T11:56:08.369935Z", "name": "Reflective Code Loading", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1620/001", "external_id": "T1620.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.370276Z", "modified": "2026-06-14T11:56:08.370276Z", "name": "Rundll32", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1218/011", "external_id": "T1218.011" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.37059Z", "modified": "2026-06-14T11:56:08.37059Z", "name": "Keylogging", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1056/001", "external_id": "T1056.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.370842Z", "modified": "2026-06-14T11:56:08.370842Z", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.371214Z", "modified": "2026-06-14T11:56:08.371214Z", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1057", "external_id": "T1057" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.371815Z", "modified": "2026-06-14T11:56:08.371815Z", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1033", "external_id": "T1033" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.372132Z", "modified": "2026-06-14T11:56:08.372132Z", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1083", "external_id": "T1083" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.372872Z", "modified": "2026-06-14T11:56:08.372872Z", "name": "Data from Local System", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1005", "external_id": "T1005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.373236Z", "modified": "2026-06-14T11:56:08.373236Z", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1071/001", "external_id": "T1071.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.373495Z", "modified": "2026-06-14T11:56:08.373495Z", "name": "Encrypted Channel: Symmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1573/001", "external_id": "T1573.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.373811Z", "modified": "2026-06-14T11:56:08.373811Z", "name": "Data Encoding: Standard Encoding", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1132/001", "external_id": "T1132.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.3741Z", "modified": "2026-06-14T11:56:08.3741Z", "name": "Non-Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1095", "external_id": "T1095" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.374335Z", "modified": "2026-06-14T11:56:08.374335Z", "name": "Protocol Tunneling", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1572", "external_id": "T1572" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.374643Z", "modified": "2026-06-14T11:56:08.374643Z", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1105", "external_id": "T1105" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.374894Z", "modified": "2026-06-14T11:56:08.374894Z", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1041", "external_id": "T1041" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.375113Z", "modified": "2026-06-14T11:56:08.375113Z", "name": "Shared Modules", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1129", "external_id": "T1129" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.37533Z", "modified": "2026-06-14T11:56:08.37533Z", "name": "Modify Registry", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1112", "external_id": "T1112" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.375589Z", "modified": "2026-06-14T11:56:08.375589Z", "name": "new-files-found-20260408 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51137d27-3329-5bfb-b2cf-fe702ad66bfa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.377093Z", "modified": "2026-06-14T11:56:08.377093Z", "relationship_type": "indicates", "source_ref": "indicator--9427c028-4d29-5459-8d42-9d771bbc8bd1", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--652e765e-4578-5cf4-b98d-94f57cddbc12", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.377794Z", "modified": "2026-06-14T11:56:08.377794Z", "relationship_type": "indicates", "source_ref": "indicator--428a11c7-2bcb-540b-8df9-962641058d5a", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a98dfbc-a6fd-5464-8996-e7b39ab53401", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.378005Z", "modified": "2026-06-14T11:56:08.378005Z", "relationship_type": "indicates", "source_ref": "indicator--7c1667ac-7b21-5a78-9ded-03b9f0ab6691", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2721d1b-eb6f-564f-bbae-798b8ea17d22", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.378231Z", "modified": "2026-06-14T11:56:08.378231Z", "relationship_type": "indicates", "source_ref": "indicator--2e361716-0124-58f9-8613-022b36caec8f", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bc1a508-d7e3-5d6f-86e7-994677ded826", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.378485Z", "modified": "2026-06-14T11:56:08.378485Z", "relationship_type": "indicates", "source_ref": "indicator--383e524d-b826-5cf1-86e6-8b44f975f8fb", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a712257-0023-562d-b296-df61c6150e24", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.378712Z", "modified": "2026-06-14T11:56:08.378712Z", "relationship_type": "indicates", "source_ref": "indicator--b79cec8e-751f-5739-9bb2-451b58f50516", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43e4f90f-df19-50fd-b525-d2ea8c829aeb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.378922Z", "modified": "2026-06-14T11:56:08.378922Z", "relationship_type": "indicates", "source_ref": "indicator--d1c94d24-f95d-5089-ad5a-0395357ce5e4", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02fe2c2c-8e97-5159-b34f-8a1786242303", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379059Z", "modified": "2026-06-14T11:56:08.379059Z", "relationship_type": "indicates", "source_ref": "indicator--f4cd733d-3951-597f-b881-411af8cc6ab4", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--78c93321-8b0a-50a7-9ad3-c8dacfbf94e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379178Z", "modified": "2026-06-14T11:56:08.379178Z", "relationship_type": "indicates", "source_ref": "indicator--26ed5ec3-103a-57ab-bd6b-3e7f35c0dd45", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f46a975-3667-580f-a866-4c18c88203ad", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379293Z", "modified": "2026-06-14T11:56:08.379293Z", "relationship_type": "indicates", "source_ref": "indicator--8c189155-13aa-51fa-a346-78c523b828aa", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d80eb77-d9b6-5e3d-b36e-0cc679c9e0f6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379405Z", "modified": "2026-06-14T11:56:08.379405Z", "relationship_type": "indicates", "source_ref": "indicator--74b54f02-d2c0-56e3-a1fd-46cce635852e", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18960203-9a85-58fb-9df3-ffbaf622332b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379525Z", "modified": "2026-06-14T11:56:08.379525Z", "relationship_type": "indicates", "source_ref": "indicator--045b71ab-f085-5ffe-bf22-f9ccfc9e2443", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ebd9bdb-4b53-5b0f-894a-26d86155186a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379649Z", "modified": "2026-06-14T11:56:08.379649Z", "relationship_type": "indicates", "source_ref": "indicator--63782934-9c11-58a9-9052-d00e1eb82002", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ecc3893-ca1a-5e39-8eec-67fc005b1b37", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379769Z", "modified": "2026-06-14T11:56:08.379769Z", "relationship_type": "indicates", "source_ref": "indicator--71a24fb1-5cb8-51ab-94d4-9ca439d8a824", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9b42c9c-e2fa-5f96-8529-e7493845e649", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.37988Z", "modified": "2026-06-14T11:56:08.37988Z", "relationship_type": "indicates", "source_ref": "indicator--60fc3b33-a6c4-5b4f-bd2c-07d5c7967a1c", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5eccb596-680c-5f58-9769-2b23f35d5c9b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.379989Z", "modified": "2026-06-14T11:56:08.379989Z", "relationship_type": "indicates", "source_ref": "indicator--ccf74ab8-506d-5e0f-899d-9f285ebd6cd7", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29da97b4-72ca-5dba-8ee4-5435a012023f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380094Z", "modified": "2026-06-14T11:56:08.380094Z", "relationship_type": "indicates", "source_ref": "indicator--2927071d-b679-54b5-94f9-0195ec568fa8", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe779e57-44b4-57af-9bd2-c514d5d3aa74", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380203Z", "modified": "2026-06-14T11:56:08.380203Z", "relationship_type": "indicates", "source_ref": "indicator--bb397b36-f476-5323-898f-5410ee954cb5", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af4c8c06-3a0e-5910-baf0-35ea91744f82", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380363Z", "modified": "2026-06-14T11:56:08.380363Z", "relationship_type": "indicates", "source_ref": "indicator--0d0cb93b-cf51-527e-862e-2e3b237b094a", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6acf36d5-408d-537c-a9f0-1ba7d0248464", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.3805Z", "modified": "2026-06-14T11:56:08.3805Z", "relationship_type": "indicates", "source_ref": "indicator--9c550b0c-4a26-5a49-8cfe-9f0b6b81eb28", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--633dd371-0cdf-5319-88a2-af741685b0c6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380629Z", "modified": "2026-06-14T11:56:08.380629Z", "relationship_type": "indicates", "source_ref": "indicator--7b8f40ae-5d52-51d6-83b3-eea661e6648a", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ebb8b554-4314-52c9-8a59-cb116938f3a4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380765Z", "modified": "2026-06-14T11:56:08.380765Z", "relationship_type": "indicates", "source_ref": "indicator--ccd48f1b-3b7e-506f-9685-dd6749f58f5b", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f448a5da-e214-571b-9efe-95cc5359336f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.380935Z", "modified": "2026-06-14T11:56:08.380935Z", "relationship_type": "indicates", "source_ref": "indicator--de08bd9e-a1f9-5800-ae22-48e451d4158d", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d16e3956-da87-5400-916f-70fc22cce908", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381064Z", "modified": "2026-06-14T11:56:08.381064Z", "relationship_type": "indicates", "source_ref": "indicator--cc37c9a6-e7f4-5892-b340-a85b839508ad", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4e683b46-8f56-5837-bcd7-871bf0c7fea7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381185Z", "modified": "2026-06-14T11:56:08.381185Z", "relationship_type": "indicates", "source_ref": "indicator--d53a318b-31c9-504b-8ee2-17538790a046", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--15ec128c-0f9e-5d13-b25a-0533e9c639b5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381304Z", "modified": "2026-06-14T11:56:08.381304Z", "relationship_type": "indicates", "source_ref": "indicator--950fc351-f249-58c0-b6d6-a9eb851201a8", "target_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c34a4bf7-3e18-55e7-ad77-f3d777f42699", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38143Z", "modified": "2026-06-14T11:56:08.38143Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51d39461-48e9-5cbf-a02e-b162d42d089b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38156Z", "modified": "2026-06-14T11:56:08.38156Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1efc2511-b3c2-52ad-9430-83c9f1ea91fb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381673Z", "modified": "2026-06-14T11:56:08.381673Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--69974704-0985-587b-b1d4-331e5347a0e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381783Z", "modified": "2026-06-14T11:56:08.381783Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd0bcf12-1a25-53b5-9367-8701e3713583", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.381896Z", "modified": "2026-06-14T11:56:08.381896Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67d8020f-7db5-5dbc-8902-cd6556010c25", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382007Z", "modified": "2026-06-14T11:56:08.382007Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0445c16-c9d1-571b-aba3-ebf6de853ac8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382113Z", "modified": "2026-06-14T11:56:08.382113Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--115ee866-da9e-54aa-9632-1fe02aa2557f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38222Z", "modified": "2026-06-14T11:56:08.38222Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddc32275-e2d6-5e92-acbc-4c9b2435dce0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382343Z", "modified": "2026-06-14T11:56:08.382343Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe9f4e53-0c07-5691-a6b1-6351265b66b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38247Z", "modified": "2026-06-14T11:56:08.38247Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a8d71da-217c-567b-a4cc-4ee2df92b94e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382604Z", "modified": "2026-06-14T11:56:08.382604Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--594991c0-399c-57a9-a305-bc968163ae25", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382739Z", "modified": "2026-06-14T11:56:08.382739Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--967b78cd-0997-5838-8bc3-1179fa625ad8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382866Z", "modified": "2026-06-14T11:56:08.382866Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5fea3d0d-0f26-59ed-9710-96e837fd8dde", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.382991Z", "modified": "2026-06-14T11:56:08.382991Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ed6cb499-ccb8-5595-8c53-2290faa87085", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383111Z", "modified": "2026-06-14T11:56:08.383111Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cdc443a6-a48b-5b82-9358-9ba7d3dd5155", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383229Z", "modified": "2026-06-14T11:56:08.383229Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2753188f-e0f5-5b82-ae3b-5da3dd8d68cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383341Z", "modified": "2026-06-14T11:56:08.383341Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e63e9ea-8ab1-54b4-b2f7-e0d62da50a78", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383446Z", "modified": "2026-06-14T11:56:08.383446Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b07ac6c7-8267-56f2-916c-c89d444ab109", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383551Z", "modified": "2026-06-14T11:56:08.383551Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd324a6d-dc90-5a3c-ad4c-a4d1d5f89074", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383671Z", "modified": "2026-06-14T11:56:08.383671Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cfc4d698-082d-5377-8e26-c8812052745d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.383805Z", "modified": "2026-06-14T11:56:08.383805Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77945f7f-a7c8-574e-aacc-bbe4f4b14b09", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.384201Z", "modified": "2026-06-14T11:56:08.384201Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c54f4038-95f6-5e8d-91e1-e31b605ac885", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.384569Z", "modified": "2026-06-14T11:56:08.384569Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55229919-fa07-59ba-aa44-a01dc3f36f22", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.384758Z", "modified": "2026-06-14T11:56:08.384758Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93536030-fb75-5c22-80a2-84f8f2dcaa41", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.384984Z", "modified": "2026-06-14T11:56:08.384984Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f02652a-1bd4-5328-af3e-10613d67733a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.385225Z", "modified": "2026-06-14T11:56:08.385225Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec974e5c-57a8-5106-a3d4-1d47c15dc4f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.385406Z", "modified": "2026-06-14T11:56:08.385406Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4874b389-ce85-5ed8-8f00-07ea81c74cb5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.386011Z", "modified": "2026-06-14T11:56:08.386011Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23f90b26-d07e-59b0-9330-3ee451406507", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.386236Z", "modified": "2026-06-14T11:56:08.386236Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a8b8b71-511f-50fd-a483-070a55fd6a97", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.386446Z", "modified": "2026-06-14T11:56:08.386446Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9be1930-cb96-59cb-a716-bb32f6c3a239", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38665Z", "modified": "2026-06-14T11:56:08.38665Z", "relationship_type": "communicates-with", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c61107b-142d-541c-b34f-f8f0cdbb5ccb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38685Z", "modified": "2026-06-14T11:56:08.38685Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a98f630-1c94-5614-bb58-48a822628738", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38705Z", "modified": "2026-06-14T11:56:08.38705Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1580598-c24a-5036-b815-3e061975ecf8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.387292Z", "modified": "2026-06-14T11:56:08.387292Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7e248f9-7246-5bdd-9762-212a54195f50", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.387502Z", "modified": "2026-06-14T11:56:08.387502Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47cb1e83-3b9d-5b16-a371-0750516c8812", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.387663Z", "modified": "2026-06-14T11:56:08.387663Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7527b06d-ea95-514a-8c60-708eb5193b68", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38781Z", "modified": "2026-06-14T11:56:08.38781Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4a133d7-3200-5c80-8d66-26a107cf4d0f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.387976Z", "modified": "2026-06-14T11:56:08.387976Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e38d5831-9a48-59d8-bdfc-a535187056f7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388138Z", "modified": "2026-06-14T11:56:08.388138Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2990b735-e3b5-5198-a075-a9e38b8f4ddc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388263Z", "modified": "2026-06-14T11:56:08.388263Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f1b7fb7-7141-50fb-8709-6bbb425fdc0c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388375Z", "modified": "2026-06-14T11:56:08.388375Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ddca11e-4eee-578e-9ff3-a5844f38771b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388482Z", "modified": "2026-06-14T11:56:08.388482Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03dccc0f-9fe7-513b-969e-230828deba1f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388592Z", "modified": "2026-06-14T11:56:08.388592Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b0297a9-3a04-56ca-99e2-d1f558abe9ee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388699Z", "modified": "2026-06-14T11:56:08.388699Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b640fc03-5924-5f87-8cf2-32edfd9c4e78", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388818Z", "modified": "2026-06-14T11:56:08.388818Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1d1504f8-4ed7-54f2-91ca-848e11cf007c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.388999Z", "modified": "2026-06-14T11:56:08.388999Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--511f247e-c7cd-5273-924d-fdc82310ac84", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389132Z", "modified": "2026-06-14T11:56:08.389132Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5318d27d-81d6-5f00-be9e-a30c6229431c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389246Z", "modified": "2026-06-14T11:56:08.389246Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--196174d6-1812-5639-bfda-61928e011c31", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389361Z", "modified": "2026-06-14T11:56:08.389361Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60a645fb-f11f-5861-b8e4-70dc8005272e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389475Z", "modified": "2026-06-14T11:56:08.389475Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--14adf2a8-360f-5fd6-8dc0-3e82620209f6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389584Z", "modified": "2026-06-14T11:56:08.389584Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85a3a075-bac3-5c5d-b7a2-f7ac3f1ee0c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389696Z", "modified": "2026-06-14T11:56:08.389696Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ed9404f-f5c9-5fa0-ae92-977dea481825", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.389835Z", "modified": "2026-06-14T11:56:08.389835Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8af27357-ace8-5bb6-9ab2-59cb0ef32ec2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.38995Z", "modified": "2026-06-14T11:56:08.38995Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba1c19f0-9fd4-57a7-ac14-6516b7800264", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390062Z", "modified": "2026-06-14T11:56:08.390062Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91404255-5db5-573a-9c97-cb313654ea40", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390175Z", "modified": "2026-06-14T11:56:08.390175Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0fe97d34-a27b-5673-beaf-f388a5cba362", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39029Z", "modified": "2026-06-14T11:56:08.39029Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7788974c-63f0-5422-bbf7-1c054047129e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390404Z", "modified": "2026-06-14T11:56:08.390404Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e193a1d-f6a3-58e7-9ac0-a8f267adabf2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390516Z", "modified": "2026-06-14T11:56:08.390516Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe5d2923-b312-58e2-b8fe-f532a51ff837", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390628Z", "modified": "2026-06-14T11:56:08.390628Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e1c3b490-5fb5-5070-bbad-7744350d06e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390746Z", "modified": "2026-06-14T11:56:08.390746Z", "relationship_type": "uses", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83831084-d75a-5c2d-a759-44ff226e8912", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.390918Z", "modified": "2026-06-14T11:56:08.390918Z", "relationship_type": "communicates-with", "source_ref": "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "target_ref": "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5144b97-0b21-50a0-af84-e43fff514164", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391054Z", "modified": "2026-06-14T11:56:08.391054Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5842b09c-9231-5110-808b-34a2c1f3f832", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391171Z", "modified": "2026-06-14T11:56:08.391171Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f2f3a92a-ef83-50b1-8aca-57304434c1e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391284Z", "modified": "2026-06-14T11:56:08.391284Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9ac4fc3-e466-5fca-9d1b-e90c9ca3b454", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391403Z", "modified": "2026-06-14T11:56:08.391403Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d19f4955-a1da-52c3-bfe0-6ccac1d0c2f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39151Z", "modified": "2026-06-14T11:56:08.39151Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0018563-4bb2-57cf-a975-a5d8ceea9ad6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391621Z", "modified": "2026-06-14T11:56:08.391621Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a8a0e99b-ec4b-55ff-a046-862a6933bb4a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391734Z", "modified": "2026-06-14T11:56:08.391734Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2cf15007-20ad-5d02-8f58-ed3c1c1fb5cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391845Z", "modified": "2026-06-14T11:56:08.391845Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36d017f6-91b2-5ea9-b234-84c10d6a1e91", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.391965Z", "modified": "2026-06-14T11:56:08.391965Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea00c754-08b2-5692-aea4-5e8448248864", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.392139Z", "modified": "2026-06-14T11:56:08.392139Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1dfbd673-0b11-569f-b4a0-172c08a5b0cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39225Z", "modified": "2026-06-14T11:56:08.39225Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3aba28c9-1ab8-5f4f-9c5c-199b7a8235a3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.392371Z", "modified": "2026-06-14T11:56:08.392371Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b30da340-f17f-5ba3-aee7-2cfe15c1d313", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.392479Z", "modified": "2026-06-14T11:56:08.392479Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--935f023d-f28c-5e9e-8e9e-898fdac6277a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.392592Z", "modified": "2026-06-14T11:56:08.392592Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df33b8a8-7d07-5ad8-93ae-3310c1b45ae7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.392719Z", "modified": "2026-06-14T11:56:08.392719Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f66a6ae7-ad42-58c1-bc3e-1d7c8e1ece53", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39287Z", "modified": "2026-06-14T11:56:08.39287Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a5182615-b13c-5946-88aa-4ec164e5c2c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393026Z", "modified": "2026-06-14T11:56:08.393026Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01dce9c6-a995-5537-98de-4b1741e3879c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39315Z", "modified": "2026-06-14T11:56:08.39315Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85bb32e3-3cf6-56a3-8214-483877d854af", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39327Z", "modified": "2026-06-14T11:56:08.39327Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44aa4d91-5cb1-55f9-99a4-90903e1f8633", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393395Z", "modified": "2026-06-14T11:56:08.393395Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b233ae07-178f-5ef4-8b6e-ae98ff20236b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393532Z", "modified": "2026-06-14T11:56:08.393532Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ecdc917-9831-538e-b9ea-927ebbe20934", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393652Z", "modified": "2026-06-14T11:56:08.393652Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3ff6ee2-c987-53d0-8ff3-a12ce05519a4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393773Z", "modified": "2026-06-14T11:56:08.393773Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c124655f-9861-5eca-a33d-e6639200ac8f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.393892Z", "modified": "2026-06-14T11:56:08.393892Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7ecbbfb4-4ae8-538e-9b1e-1b0f56fa77c4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394006Z", "modified": "2026-06-14T11:56:08.394006Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9e602f4-4a08-5354-9394-97d78bba3b03", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394112Z", "modified": "2026-06-14T11:56:08.394112Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b67409a-8fb8-5418-850d-432d1f24cee0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394215Z", "modified": "2026-06-14T11:56:08.394215Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--adebd9fb-4f23-5da6-8858-6e45b01de75b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394319Z", "modified": "2026-06-14T11:56:08.394319Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--64a4332c-5036-59bc-ae94-62b3f36352ac", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394427Z", "modified": "2026-06-14T11:56:08.394427Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--acd5fc9e-f738-5d92-a9fc-28c49534a7de", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394533Z", "modified": "2026-06-14T11:56:08.394533Z", "relationship_type": "uses", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f512d200-678c-51ad-be7e-d29872f357ee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394649Z", "modified": "2026-06-14T11:56:08.394649Z", "relationship_type": "communicates-with", "source_ref": "malware--b6fccdf4-898b-5e71-8137-47206543630b", "target_ref": "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32e1082c-9a36-53b2-b00d-2990c6e4338c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394772Z", "modified": "2026-06-14T11:56:08.394772Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de866ef7-3962-5fe7-9d27-c5f8f40b2482", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.394892Z", "modified": "2026-06-14T11:56:08.394892Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd196d84-2deb-564a-980c-1246f5820959", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395209Z", "modified": "2026-06-14T11:56:08.395209Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db9e4ef5-acec-5901-9461-02333dca50cc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395316Z", "modified": "2026-06-14T11:56:08.395316Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2f5e5be-0873-5889-a813-512534fbc4cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395422Z", "modified": "2026-06-14T11:56:08.395422Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d425aac5-1385-5ef5-ab5a-3331989c02c6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395527Z", "modified": "2026-06-14T11:56:08.395527Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db4ef74d-9932-54d7-b04e-1a9e5d90f342", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395631Z", "modified": "2026-06-14T11:56:08.395631Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86d1c376-36c7-5c81-9c89-9a9fae39fb9e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395736Z", "modified": "2026-06-14T11:56:08.395736Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87a8ac06-0fc9-5a32-b9a5-0b8721427b98", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39585Z", "modified": "2026-06-14T11:56:08.39585Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd2963f6-7be6-5c42-b375-30bc85a06906", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.395955Z", "modified": "2026-06-14T11:56:08.395955Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--896de6cc-6001-546f-abde-88f422d67384", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396064Z", "modified": "2026-06-14T11:56:08.396064Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f7d41ce-40bb-5976-b708-b7c1d41506c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396179Z", "modified": "2026-06-14T11:56:08.396179Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77ecf14a-91d4-5c3f-ac81-3d5b8e26a404", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396303Z", "modified": "2026-06-14T11:56:08.396303Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--633bf138-1805-5831-bc25-ad2c16593927", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396415Z", "modified": "2026-06-14T11:56:08.396415Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c654fe1-0c48-531f-bd3b-134a69969611", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396526Z", "modified": "2026-06-14T11:56:08.396526Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc6371a8-ffd6-5d41-bb87-ef1d74fd1257", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396645Z", "modified": "2026-06-14T11:56:08.396645Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--54063a11-5b5b-5c12-a813-3bff971726c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396778Z", "modified": "2026-06-14T11:56:08.396778Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--674d0b8c-9cc6-5630-b296-1d5ab73e41ca", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.396917Z", "modified": "2026-06-14T11:56:08.396917Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4766dd7b-11ca-5d84-9139-8803828e8cc2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397056Z", "modified": "2026-06-14T11:56:08.397056Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cdef5f2-c7e0-522c-b737-5639e5751a27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397176Z", "modified": "2026-06-14T11:56:08.397176Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b004e93-800d-5b34-b295-8bb759560f60", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397294Z", "modified": "2026-06-14T11:56:08.397294Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25d58596-23c2-5d4c-9594-ac98741be863", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397407Z", "modified": "2026-06-14T11:56:08.397407Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc30fd78-ba6a-55c2-9431-3c18a299341b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397519Z", "modified": "2026-06-14T11:56:08.397519Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2700bc20-d31c-5b49-81ad-b5abf99ccaf1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39765Z", "modified": "2026-06-14T11:56:08.39765Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da3b38a2-92d0-52ef-afdb-2f349a373283", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397761Z", "modified": "2026-06-14T11:56:08.397761Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd0c3fb0-8b77-590d-b5c8-c65bdd8fd346", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397867Z", "modified": "2026-06-14T11:56:08.397867Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4fa657db-f04b-5a9c-9b94-851b0bdf52ff", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.397974Z", "modified": "2026-06-14T11:56:08.397974Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--505885ba-68dc-502a-8d07-015bf6609a45", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398081Z", "modified": "2026-06-14T11:56:08.398081Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c08c4780-dad4-51aa-aedb-fe792b290966", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398196Z", "modified": "2026-06-14T11:56:08.398196Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9ae09a70-e93c-52e7-96aa-a0dec3165089", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398328Z", "modified": "2026-06-14T11:56:08.398328Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d1c38c1-e17b-51e9-a5f5-551acbd18299", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398461Z", "modified": "2026-06-14T11:56:08.398461Z", "relationship_type": "communicates-with", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62b0eedf-5240-5c02-9ffe-63f77f703384", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39858Z", "modified": "2026-06-14T11:56:08.39858Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--326ceb04-eb0d-586f-a71e-3730e7db79b2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1b45cab0-5679-5baf-8488-c1360a565293", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398696Z", "modified": "2026-06-14T11:56:08.398696Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--ca728090-da45-570d-9856-f87b853ecb1a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40ce2edf-84b8-5bab-8cd7-a6b8429cd3d8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.398844Z", "modified": "2026-06-14T11:56:08.398844Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--60239ccb-9be2-5044-bf2f-221d17371925", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bf9b8a0-83ee-5a7c-a58a-00691e02e923", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39899Z", "modified": "2026-06-14T11:56:08.39899Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--0936f583-379c-51f3-8973-fd3a5076487d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6cdafb6-cce3-53c6-ba3a-3796e00de118", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.399117Z", "modified": "2026-06-14T11:56:08.399117Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--af99919f-6c3f-5c4f-86ee-3c02764d9697", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35b51c5b-cf33-56dc-becd-982a4bfdb4ed", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39923Z", "modified": "2026-06-14T11:56:08.39923Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--7e96c5b8-376e-56e7-8081-b8139c662837", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--960b0a0c-36e9-50a0-93a8-bf8371db8ee7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39934Z", "modified": "2026-06-14T11:56:08.39934Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--0b0b1612-373b-5562-9c4b-f406a5ea857d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1eb70e03-9353-5bf8-a2be-128dacb36b49", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.399451Z", "modified": "2026-06-14T11:56:08.399451Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--01b1db05-01b5-5ce2-b1b3-28b89ac42029", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80d2a7f8-9d7f-59fa-9533-76072f83c6e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.39956Z", "modified": "2026-06-14T11:56:08.39956Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--965066dd-5adb-55ef-a7a0-78729f9d6905", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1edf0f4e-46d8-5c2e-a1b9-550ec96ad8db", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.399672Z", "modified": "2026-06-14T11:56:08.399672Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--c272f692-d503-5510-af2f-159eea0b2eac", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03f46ec1-b523-5437-84b7-c1464fb377b3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.399782Z", "modified": "2026-06-14T11:56:08.399782Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--57a1c9dc-aedc-5751-82ac-78759c2ca2a7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1314a990-348a-5807-8ed7-cb62729e8272", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.399929Z", "modified": "2026-06-14T11:56:08.399929Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--0716f982-817b-5e0a-9ffb-813eeacc58e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3eaf82e1-4ad0-50de-b203-3f60f7893d27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400045Z", "modified": "2026-06-14T11:56:08.400045Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--1300b7be-3dc2-5428-a531-e77da8517561", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91fd19af-801e-540d-b5f4-d08d54a26cf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.40015Z", "modified": "2026-06-14T11:56:08.40015Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--35a29184-2b1b-5dde-880d-e3fd5eb3a64f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34e7825a-5189-58b4-a6c2-a496806eb044", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400254Z", "modified": "2026-06-14T11:56:08.400254Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--b2db7b97-021e-5894-894d-be82ca1dd1d2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b42af7e-dcb6-5b85-be17-bf4c3a7d90e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400362Z", "modified": "2026-06-14T11:56:08.400362Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--db35f68a-9203-5d1d-aa63-0133476d9c9e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dbe89147-ed5b-515f-b75d-10b07f2452ec", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400481Z", "modified": "2026-06-14T11:56:08.400481Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--01c94219-dde7-56f5-8e23-4491926276db", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbe44024-4164-5c1d-ad5c-fd468b83993a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400595Z", "modified": "2026-06-14T11:56:08.400595Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--99ef2ac9-68bb-5fc8-9372-635d3c560d0f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ca98bed1-49c4-5965-ae0e-bc8b1a6c5cfe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400735Z", "modified": "2026-06-14T11:56:08.400735Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--b9425ebd-6748-5fe8-8b5b-418322ef6ef8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9f018b7-b9ad-51af-846d-90b2d2ce3804", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.400925Z", "modified": "2026-06-14T11:56:08.400925Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--a2ee2e69-60d7-5975-9cff-ec7a8bc6e4ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ab796fc-1505-54d4-8bb5-6ce0a344fd40", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.401133Z", "modified": "2026-06-14T11:56:08.401133Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--77a4f5b6-3e70-5c96-be85-533c5982da09", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f93a767-4c42-54d8-9bed-7aa27b294fa3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.401311Z", "modified": "2026-06-14T11:56:08.401311Z", "relationship_type": "related-to", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "tool--ec9845b4-4267-5bcf-a9ef-640cc8c5cec8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--4515275f-b9be-56f7-a189-401e48c3836e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-06-14T11:56:08.401695Z", "modified": "2026-06-14T11:56:08.401695Z", "name": "OpenStrike Expanded Toolkit \u2014 106 New Files, Complete CS Arsenal Exposed", "report_types": [ "threat-report" ], "published": "2026-04-08T00:00:00Z", "object_refs": [ "ipv4-addr--e35990fa-a64b-54ec-94be-6b82c22af8b3", "indicator--9427c028-4d29-5459-8d42-9d771bbc8bd1", "url--3fe8b1e3-8297-594e-98e0-7fce2cc1a53b", "indicator--428a11c7-2bcb-540b-8df9-962641058d5a", "url--ca7f35f0-8f63-5a62-bf5b-ce1f5d9f77cc", "indicator--7c1667ac-7b21-5a78-9ded-03b9f0ab6691", "url--da6b8ff5-59f5-5e97-9d9d-1250c699ffe7", "indicator--2e361716-0124-58f9-8613-022b36caec8f", "url--53225cca-1b1e-5760-92a8-258635ea795c", "indicator--383e524d-b826-5cf1-86e6-8b44f975f8fb", "url--390e3578-f50e-5513-9f5c-58b263d6a83a", "indicator--b79cec8e-751f-5739-9bb2-451b58f50516", "url--d36f8741-4637-547d-9880-a79181dcf221", "indicator--d1c94d24-f95d-5089-ad5a-0395357ce5e4", "file--18955408-a8e9-58be-8839-c3945fd7cb41", "file--9a23d80e-9664-5030-bb5c-f2adc9030260", "file--2b4a6ccb-289b-5e9f-8857-f19fc9df42b7", "file--c61b2070-a015-541d-8923-ec3e75939744", "file--4d6b1c23-bd58-5afa-9b70-fc74dedd1bb8", "file--4ece9763-201b-59d0-8bb9-c714f16ddbd4", "file--61f4103d-afb1-5673-8456-9514b64bbfc2", "file--6875b98c-35ce-56c2-831b-61b9efa37add", "file--beb6ec3d-6a54-52b7-8407-847607a50cb5", "file--a68c6c6d-c7eb-53e7-9739-627d0fa0216d", "file--9d7a92ea-ff5d-51b5-be15-b536e2a4435a", "file--73404bf3-fb6b-5fcb-9f85-36f5a14d4467", "file--09af6f20-cfc3-5070-ace6-21c987087ae7", "file--c3c883ce-419d-583e-8e9f-7160c274f3e1", "file--5543d6b7-20a3-5822-8010-70158fc5aa17", "file--d8667f4d-4884-52d7-b91a-073fc4aa13c1", "file--31ff33f7-909f-5e3a-bd82-c4604b535a60", "file--0af3acc6-c965-57e5-82b0-55d2ebf3df70", "file--34c1c23e-bd3d-588b-9b52-80fdf5ca4707", "file--eb2a64d4-c0cc-5321-84b5-e91ebab86eac", "file--5ff4580e-100e-5c51-b585-45fdf008f8df", "indicator--f4cd733d-3951-597f-b881-411af8cc6ab4", "indicator--26ed5ec3-103a-57ab-bd6b-3e7f35c0dd45", "indicator--8c189155-13aa-51fa-a346-78c523b828aa", "indicator--74b54f02-d2c0-56e3-a1fd-46cce635852e", "indicator--045b71ab-f085-5ffe-bf22-f9ccfc9e2443", "indicator--63782934-9c11-58a9-9052-d00e1eb82002", "indicator--71a24fb1-5cb8-51ab-94d4-9ca439d8a824", "indicator--60fc3b33-a6c4-5b4f-bd2c-07d5c7967a1c", "indicator--ccf74ab8-506d-5e0f-899d-9f285ebd6cd7", "indicator--2927071d-b679-54b5-94f9-0195ec568fa8", "indicator--bb397b36-f476-5323-898f-5410ee954cb5", "indicator--0d0cb93b-cf51-527e-862e-2e3b237b094a", "indicator--9c550b0c-4a26-5a49-8cfe-9f0b6b81eb28", "indicator--7b8f40ae-5d52-51d6-83b3-eea661e6648a", "indicator--ccd48f1b-3b7e-506f-9685-dd6749f58f5b", "indicator--de08bd9e-a1f9-5800-ae22-48e451d4158d", "indicator--cc37c9a6-e7f4-5892-b340-a85b839508ad", "indicator--d53a318b-31c9-504b-8ee2-17538790a046", "indicator--950fc351-f249-58c0-b6d6-a9eb851201a8", "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "malware--674a1750-44b2-5dde-935d-e94c7b049d4f", "malware--b6fccdf4-898b-5e71-8137-47206543630b", "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "tool--326ceb04-eb0d-586f-a71e-3730e7db79b2", "tool--ca728090-da45-570d-9856-f87b853ecb1a", "tool--60239ccb-9be2-5044-bf2f-221d17371925", "tool--0936f583-379c-51f3-8973-fd3a5076487d", "tool--af99919f-6c3f-5c4f-86ee-3c02764d9697", "tool--7e96c5b8-376e-56e7-8081-b8139c662837", "tool--0b0b1612-373b-5562-9c4b-f406a5ea857d", "tool--01b1db05-01b5-5ce2-b1b3-28b89ac42029", "tool--965066dd-5adb-55ef-a7a0-78729f9d6905", "tool--c272f692-d503-5510-af2f-159eea0b2eac", "tool--57a1c9dc-aedc-5751-82ac-78759c2ca2a7", "tool--0716f982-817b-5e0a-9ffb-813eeacc58e1", "tool--1300b7be-3dc2-5428-a531-e77da8517561", "tool--35a29184-2b1b-5dde-880d-e3fd5eb3a64f", "tool--b2db7b97-021e-5894-894d-be82ca1dd1d2", "tool--db35f68a-9203-5d1d-aa63-0133476d9c9e", "tool--01c94219-dde7-56f5-8e23-4491926276db", "tool--99ef2ac9-68bb-5fc8-9372-635d3c560d0f", "tool--b9425ebd-6748-5fe8-8b5b-418322ef6ef8", "tool--a2ee2e69-60d7-5975-9cff-ec7a8bc6e4ce", "tool--77a4f5b6-3e70-5c96-be85-533c5982da09", "tool--ec9845b4-4267-5bcf-a9ef-640cc8c5cec8", "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "attack-pattern--c1d497a1-fd18-5b75-9bd4-65dcf03ad8e2", "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "attack-pattern--8c9dab61-1b1e-554b-ae76-a13fda91d1cb", "attack-pattern--e25a774b-8b76-509b-9f62-b3a5810bad30", "attack-pattern--d00141fc-37fa-5b54-9d20-a7bd180eeb75", "attack-pattern--6658900e-2ea1-58c9-8299-3af19b543ee6", "attack-pattern--f38353ba-cfac-577c-ac86-5e3f0c5fb314", "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "attack-pattern--7b6881c0-36d7-56bd-823a-b3b4adbb76d7", "attack-pattern--5c1081c7-e33d-55eb-872f-8d005d4b0f96", "attack-pattern--80b14c50-a83e-5710-bab3-dcfeb4e392e8", "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "attack-pattern--85a49140-85ae-5130-8b39-bf9a5e79df72", "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "attack-pattern--ab386774-9556-5bc2-8927-6d98193000ec", "attack-pattern--030bfe25-492a-5e3f-aad5-1c799345aa06", "attack-pattern--81ac1dd0-a8ac-50ba-bd1a-cec2886340d5", "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "attack-pattern--6d38de24-9bca-5bff-88fe-f184b37c730b", "infrastructure--6f450564-44c7-5a5f-872a-428fa5dff12d", "relationship--51137d27-3329-5bfb-b2cf-fe702ad66bfa", "relationship--652e765e-4578-5cf4-b98d-94f57cddbc12", "relationship--5a98dfbc-a6fd-5464-8996-e7b39ab53401", "relationship--c2721d1b-eb6f-564f-bbae-798b8ea17d22", "relationship--9bc1a508-d7e3-5d6f-86e7-994677ded826", "relationship--9a712257-0023-562d-b296-df61c6150e24", "relationship--43e4f90f-df19-50fd-b525-d2ea8c829aeb", "relationship--02fe2c2c-8e97-5159-b34f-8a1786242303", "relationship--78c93321-8b0a-50a7-9ad3-c8dacfbf94e0", "relationship--5f46a975-3667-580f-a866-4c18c88203ad", "relationship--8d80eb77-d9b6-5e3d-b36e-0cc679c9e0f6", "relationship--18960203-9a85-58fb-9df3-ffbaf622332b", "relationship--5ebd9bdb-4b53-5b0f-894a-26d86155186a", "relationship--5ecc3893-ca1a-5e39-8eec-67fc005b1b37", "relationship--c9b42c9c-e2fa-5f96-8529-e7493845e649", "relationship--5eccb596-680c-5f58-9769-2b23f35d5c9b", "relationship--29da97b4-72ca-5dba-8ee4-5435a012023f", "relationship--fe779e57-44b4-57af-9bd2-c514d5d3aa74", "relationship--af4c8c06-3a0e-5910-baf0-35ea91744f82", "relationship--6acf36d5-408d-537c-a9f0-1ba7d0248464", "relationship--633dd371-0cdf-5319-88a2-af741685b0c6", "relationship--ebb8b554-4314-52c9-8a59-cb116938f3a4", "relationship--f448a5da-e214-571b-9efe-95cc5359336f", "relationship--d16e3956-da87-5400-916f-70fc22cce908", "relationship--4e683b46-8f56-5837-bcd7-871bf0c7fea7", "relationship--15ec128c-0f9e-5d13-b25a-0533e9c639b5", "relationship--c34a4bf7-3e18-55e7-ad77-f3d777f42699", "relationship--51d39461-48e9-5cbf-a02e-b162d42d089b", "relationship--1efc2511-b3c2-52ad-9430-83c9f1ea91fb", "relationship--69974704-0985-587b-b1d4-331e5347a0e3", "relationship--bd0bcf12-1a25-53b5-9367-8701e3713583", "relationship--67d8020f-7db5-5dbc-8902-cd6556010c25", "relationship--a0445c16-c9d1-571b-aba3-ebf6de853ac8", "relationship--115ee866-da9e-54aa-9632-1fe02aa2557f", "relationship--ddc32275-e2d6-5e92-acbc-4c9b2435dce0", "relationship--fe9f4e53-0c07-5691-a6b1-6351265b66b6", "relationship--6a8d71da-217c-567b-a4cc-4ee2df92b94e", "relationship--594991c0-399c-57a9-a305-bc968163ae25", "relationship--967b78cd-0997-5838-8bc3-1179fa625ad8", "relationship--5fea3d0d-0f26-59ed-9710-96e837fd8dde", "relationship--ed6cb499-ccb8-5595-8c53-2290faa87085", "relationship--cdc443a6-a48b-5b82-9358-9ba7d3dd5155", "relationship--2753188f-e0f5-5b82-ae3b-5da3dd8d68cf", "relationship--8e63e9ea-8ab1-54b4-b2f7-e0d62da50a78", "relationship--b07ac6c7-8267-56f2-916c-c89d444ab109", "relationship--fd324a6d-dc90-5a3c-ad4c-a4d1d5f89074", "relationship--cfc4d698-082d-5377-8e26-c8812052745d", "relationship--77945f7f-a7c8-574e-aacc-bbe4f4b14b09", "relationship--c54f4038-95f6-5e8d-91e1-e31b605ac885", "relationship--55229919-fa07-59ba-aa44-a01dc3f36f22", "relationship--93536030-fb75-5c22-80a2-84f8f2dcaa41", "relationship--6f02652a-1bd4-5328-af3e-10613d67733a", "relationship--ec974e5c-57a8-5106-a3d4-1d47c15dc4f0", "relationship--4874b389-ce85-5ed8-8f00-07ea81c74cb5", "relationship--23f90b26-d07e-59b0-9330-3ee451406507", "relationship--4a8b8b71-511f-50fd-a483-070a55fd6a97", "relationship--f9be1930-cb96-59cb-a716-bb32f6c3a239", "relationship--2c61107b-142d-541c-b34f-f8f0cdbb5ccb", "relationship--6a98f630-1c94-5614-bb58-48a822628738", "relationship--a1580598-c24a-5036-b815-3e061975ecf8", "relationship--e7e248f9-7246-5bdd-9762-212a54195f50", "relationship--47cb1e83-3b9d-5b16-a371-0750516c8812", "relationship--7527b06d-ea95-514a-8c60-708eb5193b68", "relationship--e4a133d7-3200-5c80-8d66-26a107cf4d0f", "relationship--e38d5831-9a48-59d8-bdfc-a535187056f7", "relationship--2990b735-e3b5-5198-a075-a9e38b8f4ddc", "relationship--1f1b7fb7-7141-50fb-8709-6bbb425fdc0c", "relationship--5ddca11e-4eee-578e-9ff3-a5844f38771b", "relationship--03dccc0f-9fe7-513b-969e-230828deba1f", "relationship--9b0297a9-3a04-56ca-99e2-d1f558abe9ee", "relationship--b640fc03-5924-5f87-8cf2-32edfd9c4e78", "relationship--1d1504f8-4ed7-54f2-91ca-848e11cf007c", "relationship--511f247e-c7cd-5273-924d-fdc82310ac84", "relationship--5318d27d-81d6-5f00-be9e-a30c6229431c", "relationship--196174d6-1812-5639-bfda-61928e011c31", "relationship--60a645fb-f11f-5861-b8e4-70dc8005272e", "relationship--14adf2a8-360f-5fd6-8dc0-3e82620209f6", "relationship--85a3a075-bac3-5c5d-b7a2-f7ac3f1ee0c9", "relationship--4ed9404f-f5c9-5fa0-ae92-977dea481825", "relationship--8af27357-ace8-5bb6-9ab2-59cb0ef32ec2", "relationship--ba1c19f0-9fd4-57a7-ac14-6516b7800264", "relationship--91404255-5db5-573a-9c97-cb313654ea40", "relationship--0fe97d34-a27b-5673-beaf-f388a5cba362", "relationship--7788974c-63f0-5422-bbf7-1c054047129e", "relationship--2e193a1d-f6a3-58e7-9ac0-a8f267adabf2", "relationship--fe5d2923-b312-58e2-b8fe-f532a51ff837", "relationship--e1c3b490-5fb5-5070-bbad-7744350d06e0", "relationship--83831084-d75a-5c2d-a759-44ff226e8912", "relationship--b5144b97-0b21-50a0-af84-e43fff514164", "relationship--5842b09c-9231-5110-808b-34a2c1f3f832", "relationship--f2f3a92a-ef83-50b1-8aca-57304434c1e0", "relationship--d9ac4fc3-e466-5fca-9d1b-e90c9ca3b454", "relationship--d19f4955-a1da-52c3-bfe0-6ccac1d0c2f1", "relationship--a0018563-4bb2-57cf-a975-a5d8ceea9ad6", "relationship--a8a0e99b-ec4b-55ff-a046-862a6933bb4a", "relationship--2cf15007-20ad-5d02-8f58-ed3c1c1fb5cb", "relationship--36d017f6-91b2-5ea9-b234-84c10d6a1e91", "relationship--ea00c754-08b2-5692-aea4-5e8448248864", "relationship--1dfbd673-0b11-569f-b4a0-172c08a5b0cb", "relationship--3aba28c9-1ab8-5f4f-9c5c-199b7a8235a3", "relationship--b30da340-f17f-5ba3-aee7-2cfe15c1d313", "relationship--935f023d-f28c-5e9e-8e9e-898fdac6277a", "relationship--df33b8a8-7d07-5ad8-93ae-3310c1b45ae7", "relationship--f66a6ae7-ad42-58c1-bc3e-1d7c8e1ece53", "relationship--a5182615-b13c-5946-88aa-4ec164e5c2c9", "relationship--01dce9c6-a995-5537-98de-4b1741e3879c", "relationship--85bb32e3-3cf6-56a3-8214-483877d854af", "relationship--44aa4d91-5cb1-55f9-99a4-90903e1f8633", "relationship--b233ae07-178f-5ef4-8b6e-ae98ff20236b", "relationship--0ecdc917-9831-538e-b9ea-927ebbe20934", "relationship--e3ff6ee2-c987-53d0-8ff3-a12ce05519a4", "relationship--c124655f-9861-5eca-a33d-e6639200ac8f", "relationship--7ecbbfb4-4ae8-538e-9b1e-1b0f56fa77c4", "relationship--e9e602f4-4a08-5354-9394-97d78bba3b03", "relationship--9b67409a-8fb8-5418-850d-432d1f24cee0", "relationship--adebd9fb-4f23-5da6-8858-6e45b01de75b", "relationship--64a4332c-5036-59bc-ae94-62b3f36352ac", "relationship--acd5fc9e-f738-5d92-a9fc-28c49534a7de", "relationship--f512d200-678c-51ad-be7e-d29872f357ee", "relationship--32e1082c-9a36-53b2-b00d-2990c6e4338c", "relationship--de866ef7-3962-5fe7-9d27-c5f8f40b2482", "relationship--cd196d84-2deb-564a-980c-1246f5820959", "relationship--db9e4ef5-acec-5901-9461-02333dca50cc", "relationship--c2f5e5be-0873-5889-a813-512534fbc4cf", "relationship--d425aac5-1385-5ef5-ab5a-3331989c02c6", "relationship--db4ef74d-9932-54d7-b04e-1a9e5d90f342", "relationship--86d1c376-36c7-5c81-9c89-9a9fae39fb9e", "relationship--87a8ac06-0fc9-5a32-b9a5-0b8721427b98", "relationship--dd2963f6-7be6-5c42-b375-30bc85a06906", "relationship--896de6cc-6001-546f-abde-88f422d67384", "relationship--9f7d41ce-40bb-5976-b708-b7c1d41506c9", "relationship--77ecf14a-91d4-5c3f-ac81-3d5b8e26a404", "relationship--633bf138-1805-5831-bc25-ad2c16593927", "relationship--7c654fe1-0c48-531f-bd3b-134a69969611", "relationship--fc6371a8-ffd6-5d41-bb87-ef1d74fd1257", "relationship--54063a11-5b5b-5c12-a813-3bff971726c9", "relationship--674d0b8c-9cc6-5630-b296-1d5ab73e41ca", "relationship--4766dd7b-11ca-5d84-9139-8803828e8cc2", "relationship--8cdef5f2-c7e0-522c-b737-5639e5751a27", "relationship--8b004e93-800d-5b34-b295-8bb759560f60", "relationship--25d58596-23c2-5d4c-9594-ac98741be863", "relationship--fc30fd78-ba6a-55c2-9431-3c18a299341b", "relationship--2700bc20-d31c-5b49-81ad-b5abf99ccaf1", "relationship--da3b38a2-92d0-52ef-afdb-2f349a373283", "relationship--fd0c3fb0-8b77-590d-b5c8-c65bdd8fd346", "relationship--4fa657db-f04b-5a9c-9b94-851b0bdf52ff", "relationship--505885ba-68dc-502a-8d07-015bf6609a45", "relationship--c08c4780-dad4-51aa-aedb-fe792b290966", "relationship--9ae09a70-e93c-52e7-96aa-a0dec3165089", "relationship--4d1c38c1-e17b-51e9-a5f5-551acbd18299", "relationship--62b0eedf-5240-5c02-9ffe-63f77f703384", "relationship--1b45cab0-5679-5baf-8488-c1360a565293", "relationship--40ce2edf-84b8-5bab-8cd7-a6b8429cd3d8", "relationship--9bf9b8a0-83ee-5a7c-a58a-00691e02e923", "relationship--e6cdafb6-cce3-53c6-ba3a-3796e00de118", "relationship--35b51c5b-cf33-56dc-becd-982a4bfdb4ed", "relationship--960b0a0c-36e9-50a0-93a8-bf8371db8ee7", "relationship--1eb70e03-9353-5bf8-a2be-128dacb36b49", "relationship--80d2a7f8-9d7f-59fa-9533-76072f83c6e3", "relationship--1edf0f4e-46d8-5c2e-a1b9-550ec96ad8db", "relationship--03f46ec1-b523-5437-84b7-c1464fb377b3", "relationship--1314a990-348a-5807-8ed7-cb62729e8272", "relationship--3eaf82e1-4ad0-50de-b203-3f60f7893d27", "relationship--91fd19af-801e-540d-b5f4-d08d54a26cf7", "relationship--34e7825a-5189-58b4-a6c2-a496806eb044", "relationship--9b42af7e-dcb6-5b85-be17-bf4c3a7d90e3", "relationship--dbe89147-ed5b-515f-b75d-10b07f2452ec", "relationship--cbe44024-4164-5c1d-ad5c-fd468b83993a", "relationship--ca98bed1-49c4-5965-ae0e-bc8b1a6c5cfe", "relationship--d9f018b7-b9ad-51af-846d-90b2d2ce3804", "relationship--1ab796fc-1505-54d4-8bb5-6ce0a344fd40", "relationship--9f93a767-4c42-54d8-9bed-7aa27b294fa3" ], "labels": [ "Toolkit", "C2", "Injection", "Open Dir" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/new-files-found-20260408/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }