{ "type": "bundle", "id": "bundle--75e31b0a-b3ce-434f-9efd-2ba2b605b253", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.585086Z", "modified": "2026-10-01T19:54:15.585086Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--e35990fa-a64b-54ec-94be-6b82c22af8b3", "value": "172.105.0.126" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9427c028-4d29-5459-8d42-9d771bbc8bd1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.585649Z", "modified": "2026-10-01T19:54:15.585649Z", "name": "ipv4: 172.105.0.126", "description": "Primary C2 server - hardcoded in beacon.exe, beacon_patched.x64.dll config, and stager.exe. Linode/Akamai hosted VPS. | MODERATE - Linode shared hosting IP; block only in context of associated behavioral indicators", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.105.0.126']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--df2a41f8-6227-5cfe-90f7-abe3241f998b", "value": "https://172.105.0.126:8443/qz99" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ae68ae51-a087-5162-9a0b-1d5aa6d808a2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.588355Z", "modified": "2026-10-01T19:54:15.588355Z", "name": "url: https://172.105.0.126:8443/qz99", "description": "Stage 1 shellcode download endpoint used by stager.exe - distinctive URI path", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://172.105.0.126:8443/qz99']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--6e39bf1f-cf2f-5a07-9fcc-dc1397a14632", "value": "https://172.105.0.126:8443/register" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--600f0a6d-5076-5b30-9bef-18bf21175253", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.589076Z", "modified": "2026-10-01T19:54:15.589076Z", "name": "url: https://172.105.0.126:8443/register", "description": "RSA-2048 registration handshake endpoint (beacon.exe, beacon_universal.py)", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://172.105.0.126:8443/register']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--b3738d8f-6d61-5a2f-8a84-6a0d8061457d", "value": "https://172.105.0.126:8443/submit" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9096b844-2259-5f22-ad82-ea8bf0c22dfc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.589497Z", "modified": "2026-10-01T19:54:15.589497Z", "name": "url: https://172.105.0.126:8443/submit", "description": "Output submission endpoint - POST with ?id= query parameter", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://172.105.0.126:8443/submit']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--32127a8d-ae58-5229-a2ab-74ec48b0f0f2", "value": "https://172.105.0.126:8443/submit.php" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--45d3b14f-1c2d-511a-9858-3d8ceed46319", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.58992Z", "modified": "2026-10-01T19:54:15.58992Z", "name": "url: https://172.105.0.126:8443/submit.php", "description": "Beacon output submission endpoint referenced via HTTP GET in network-layer detection content (Sigma/Suricata rules in open-directory-172-105-0-126-20260406-detections). Distinct from /submit (POST), the C beacon's documented output-submission path recorded above; attributed to the co-hosted Cobalt Strike DLL beacon's GET-based output-accumulator behavior against its Malleable C2 get_uri, and retained as a separate MODERATE-confidence indicator.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://172.105.0.126:8443/submit.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "url", "spec_version": "2.1", "id": "url--1ce48054-f232-5de8-b208-8299aaf81f74", "value": "https://172.105.0.126:8443/updates" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--11d351db-d751-5512-a1f4-270bd25c082c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.590278Z", "modified": "2026-10-01T19:54:15.590278Z", "name": "url: https://172.105.0.126:8443/updates", "description": "Task polling endpoint - GET with ?id= query parameter", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://172.105.0.126:8443/updates']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-06T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "file", "spec_version": "2.1", "id": "file--4ad7c842-1c5e-55ae-8cd7-400b736196ed", "hashes": { "SHA-256": "485abd7c34af8ab8a11b01d97feee822e1400b6cbc6b87a01e8218fc4ad52e17" } }, { "type": "file", "spec_version": "2.1", "id": "file--011631d8-4e2b-5ffb-b1c5-1c127b1dcae0", "hashes": { "SHA-256": "544b59fe4d490cc413bb20d03a5cf87d55892929a59cbdfff6fb06c4ee0cee5f" } }, { "type": "file", "spec_version": "2.1", "id": "file--1d84f28c-b742-504d-8ee6-2c6283729d90", "hashes": { "SHA-256": "68768be9ace9152c7c9cc36d8104ebf7523ba3e8e0104cabc4c8f75e1f7d3d3c" } }, { "type": "file", "spec_version": "2.1", "id": "file--42981512-e89f-5ef4-abd3-8311508a914b", "hashes": { "SHA-256": "6a8e365c48a9b64770e23ea85eb1ea2ed39b69c632e92d19125d10fa50874b0f" } }, { "type": "file", "spec_version": "2.1", "id": "file--4f7cc071-35e6-5025-9be1-0649ca1491d5", "hashes": { "SHA-256": "74d1b5b84a650a7bb1b0c1dca0be556b74567537c80a764cbf777814358ab279" } }, { "type": "file", "spec_version": "2.1", "id": "file--1dbaad8b-e02e-5fea-8410-244842de022a", "hashes": { "SHA-256": "7a1a7659ec4201ecbca782bcedf9d4079265137279a490368309df3bd39297a4" } }, { "type": "file", "spec_version": "2.1", "id": "file--e7fc303f-c25d-5bd6-9de5-4b7eb688784a", "hashes": { "SHA-256": "7d6a17754f086b53ee294f5ccd60b0127f921520ce7b64fea0aebb47114fb5d2" } }, { "type": "file", "spec_version": "2.1", "id": "file--64828200-59cb-5391-9a93-8a0c866dfa5e", "hashes": { "SHA-256": "807e24403bb5cb8407a69ff4f12a455e81609b1fcf4720cf00134b9d520136a9" } }, { "type": "file", "spec_version": "2.1", "id": "file--f2cae10d-f024-5c23-b42e-dc21950b58fd", "hashes": { "SHA-256": "821f815fab92fee03e2be44ad5370a953db085cd359a99519a2ddb7316b0d273" } }, { "type": "file", "spec_version": "2.1", "id": "file--7e4eb8c9-cfc5-57fa-8799-3f4852698cfd", "hashes": { "SHA-256": "8301a685c8f3d770420c760f495fa930eae6a03a6721e946f3ce28f6fc144449" } }, { "type": "file", "spec_version": "2.1", "id": "file--72d52f02-4466-5a79-9639-d29a05ea2aff", "hashes": { "SHA-256": "ab68ce00f8a08e0f13df2499db5e413000fda23c6fd40f23a4d4d6c71d8060c3" } }, { "type": "file", "spec_version": "2.1", "id": "file--ff40f8bf-a4fa-5a7c-8b53-9e17229d3f9c", "hashes": { "SHA-256": "d04914a1c62f7592143aa70a3746733580a6e7345073d79d1bbcd312d87d05d0" } }, { "type": "file", "spec_version": "2.1", "id": "file--2e736f29-2f82-5391-89b6-0316a571b095", "hashes": { "SHA-256": "eed84220ed7365b87d504f7709bd89ba2e255159d52f214f40a435ff78696eb6" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28ec31c3-407c-5b53-b1e4-c7e0cb6ae4ef", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59355Z", "modified": "2026-10-11T05:44:22.684258Z", "name": "RAT_OpenStrike_C_Beacon", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Yara Rule Set\n Identifier: OpenStrike Beacon Toolkit + Cobalt Strike 3.x Tripwired Loader\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule RAT_OpenStrike_C_Beacon {\n meta:\n description = \"Detects the OpenStrike custom C C2 beacon (beacon.exe) via its operator-written startup/status debug strings (the startup banner, or the registration-successful and beacon-ready pair), paired with at least one of four secondary strings: the shared AES IV, the aes_cbc_encrypt name, the hmac_sha256 name or the MinGW GCC 15 build banner. One secondary string suffices\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\"\n date = \"2026-04-06\"\n hash1 = \"7d6a17754f086b53ee294f5ccd60b0127f921520ce7b64fea0aebb47114fb5d2\"\n hash2 = \"5ee00147140b084f93d2144c2ee5c0d4d125ff1c\"\n hash3 = \"96f9adb7ee00c44bc5f523d1f1dc8715\"\n family = \"OpenStrike\"\n malware_type = \"C2 Beacon\"\n campaign = \"OpenStrike-CSBeacon-Toolkit-172.105.0.126\"\n id = \"c5b35b66-2737-5545-a27e-b67969ef4f36\"\n strings:\n $s1 = \"[*] OpenStrike Beacon starting...\" ascii\n $s2 = \"[+] Registration successful\" ascii\n $s3 = \"beacon ready\" ascii\n $s4 = \"abcdefghijklmnop\" ascii\n $s5 = \"aes_cbc_encrypt\" ascii\n $s6 = \"hmac_sha256\" ascii\n $compiler = \"GCC: (GNU) 15-win32\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 409600 and\n ($s1 or ($s2 and $s3)) and\n ($s4 or $s5 or $s6 or $compiler)\n}", "pattern_type": "yara", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--de77065d-1422-50cc-9ac1-e9559067cd32", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.593671Z", "modified": "2026-10-11T05:44:22.684406Z", "name": "TOOLKIT_OpenStrike_Loader_Chain", "indicator_types": [ "malicious-activity" ], "pattern": "rule TOOLKIT_OpenStrike_Loader_Chain {\n meta:\n description = \"Detects OpenStrike's standalone shellcode loader chain (run.exe, sc_loader.exe, veh_loader.exe, dbg_loader.exe, stager.exe) via operator-written crash-handler and entry-point-discovery debug strings shared across the progressive SEH/VEH/INT3 capability chain. Each crash-handler or INT3 string is paired with the [*] Loading %s string; only the [+] %lu @ %p exec string is paired with the MinGW GCC 15 build banner\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\"\n date = \"2026-04-06\"\n hash1 = \"821f815fab92fee03e2be44ad5370a953db085cd359a99519a2ddb7316b0d273\"\n hash2 = \"720ea472060e080145927d33e18dca9b8b1eafa5\"\n hash3 = \"d677794618461b3bf7d405a8297d5df4\"\n family = \"OpenStrike\"\n malware_type = \"Shellcode Loader\"\n campaign = \"OpenStrike-CSBeacon-Toolkit-172.105.0.126\"\n id = \"1c8e4dfb-3f93-5a20-ba24-9896e2c32761\"\n strings:\n $veh = \"[CRASH] code=0x%08lX RIP=0x%llX\" ascii\n $seh = \"[!] EXCEPTION code=0x%08lX addr=%p (base+0x%llX)\" ascii\n $dbg = \"[*] INT3 set at offset %lu (RVA 0x%llX)\" ascii\n $run = \"[+] %lu @ %p exec\" ascii\n $load = \"[*] Loading %s\" ascii\n $compiler = \"GCC: (GNU) 15-win32\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 409600 and\n (($veh and $load) or ($seh and $load) or ($dbg and $load) or ($run and $compiler))\n}", "pattern_type": "yara", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c82deec6-386a-575b-81ce-c05c915ecc68", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59377Z", "modified": "2026-10-01T19:54:15.59377Z", "name": "TOOLKIT_OpenStrike_Python_Beacon", "indicator_types": [ "malicious-activity" ], "pattern": "rule TOOLKIT_OpenStrike_Python_Beacon {\n meta:\n description = \"Detects the OpenStrike cross-platform Python beacon (beacon_universal.py) via its self-identification banner, corroborated by the distinctive /qz99 staging URI, the hardcoded RSA-2048 public key modulus prefix, or the paired bof_executor + shared AES IV strings\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\"\n date = \"2026-04-06\"\n family = \"OpenStrike\"\n malware_type = \"C2 Beacon\"\n campaign = \"OpenStrike-CSBeacon-Toolkit-172.105.0.126\"\n id = \"8064ca73-601a-5985-a11b-67d1fcd50397\"\n strings:\n $desc = \"OpenStrike Universal Beacon\" ascii\n $bof_key = \"bof_executor\" ascii\n $iv = \"abcdefghijklmnop\" ascii\n $rsa_mod = \"9f12c9cb6582f379088600e6cdb7ac80\" ascii\n $qz99 = \"/qz99\" ascii\n condition:\n filesize < 204800 and\n $desc and\n ($rsa_mod or $qz99 or ($bof_key and $iv))\n}", "pattern_type": "yara", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bf8476f9-048b-55b3-91a6-8d3c92e66ca5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T05:44:22.684625Z", "modified": "2026-10-11T05:44:22.684625Z", "name": "MALW_CobaltStrike3x_MALC_Malleable_Profile_Beacon", "indicator_types": [ "malicious-activity" ], "pattern": "rule MALW_CobaltStrike3x_MALC_Malleable_Profile_Beacon {\n meta:\n description = \"Detects the operator-modified Cobalt Strike 3.x DLL beacon (beacon_patched.x64.dll) sharing this campaign's Malleable C2 profile via its distinctive MALC User-Agent suffix, corroborated by any two of five strings: the original DLL name, the ReflectiveLoader export name, the sysnative rundll32 spawn-to path, the shared custom AES IV, or the byte pattern 66 90 CC (xchg ax,ax; int3), which the report ties to the sample's entry-point tripwire. The bytes are matched anywhere in the file and the entry point is not checked\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\"\n date = \"2026-04-06\"\n hash1 = \"7a1a7659ec4201ecbca782bcedf9d4079265137279a490368309df3bd39297a4\"\n hash2 = \"add3893c3652947ff821a6da5fad774cc041bb73\"\n hash3 = \"2a6a3d499bb3c666f3b4bc5905a866f3\"\n family = \"CobaltStrike\"\n malware_type = \"C2 Beacon\"\n campaign = \"OpenStrike-CSBeacon-Toolkit-172.105.0.126\"\n id = \"0f1b88a7-00a7-56e5-8503-6bbcf89432b7\"\n strings:\n $reflective_export = \"ReflectiveLoader\" ascii\n $original_name = \"beacon.x64.dll\" ascii\n $tripwire = { 66 90 CC }\n $ua = \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)\" ascii\n $spawn = \"%windir%\\\\sysnative\\\\rundll32.exe\" ascii\n $aes_iv = \"abcdefghijklmnop\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 409600 and\n $ua and\n 2 of ($original_name, $reflective_export, $spawn, $aes_iv, $tripwire)\n}", "pattern_type": "yara", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f6627e9-c513-5f19-bbb8-382993ac7595", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59394Z", "modified": "2026-10-01T19:54:15.59394Z", "name": "Cobalt Strike Malleable C2 Profile MALC User-Agent in Proxy Traffic", "indicator_types": [ "malicious-activity" ], "pattern": "title: Cobalt Strike Malleable C2 Profile MALC User-Agent in Proxy Traffic\nid: 9e3c7a15-6f2b-4d84-a1c9-8b5e2d7f3a61\nstatus: experimental\ndescription: >-\n Detects the Cobalt Strike 3.x Malleable C2 profile User-Agent string ending\n in the MALC suffix (full string: Mozilla/5.0 (compatible; MSIE 9.0;\n Windows NT 6.1; WOW64; Trident/5.0; MALC)). This non-standard suffix is a\n distinctive indicator of a configured Malleable C2 profile and does not\n appear in any known legitimate browser or application user-agent string.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-06\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - detection.emerging-threats\n - stp.3\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-user-agent|endswith: 'MALC)'\n condition: selection\nfalsepositives:\n - >-\n Internal applications or monitoring tools with custom user-agent\n strings ending in the substring MALC) (verify against known software\n inventory before tuning out)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--10f1abe9-6ea3-5972-81b7-118c20aa2908", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T14:08:29.825857Z", "modified": "2026-10-11T14:08:29.825857Z", "name": "Python Interpreter With Ctypes and VirtualAlloc on the Command Line", "indicator_types": [ "malicious-activity" ], "pattern": "title: Python Interpreter With Ctypes and VirtualAlloc on the Command Line\nid: 1d6b4e82-9f3c-4a17-b5d8-2e7c9a6f1b34\nstatus: experimental\ndescription: >-\n Detects a python.exe, pythonw.exe or python3.exe process whose command line\n references both ctypes and VirtualAlloc, the calls the OpenStrike\n beacon_universal.py cross-platform shellcode injection pattern relies on.\n The rule carries no OpenStrike marker and does not see a beacon run from a\n script file, which keeps both strings off the command line. The Python beacon uses\n ctypes.windll to call VirtualAlloc for RWX memory allocation and\n CreateThread for shellcode execution, enabling in-memory payload staging\n without dropping a compiled binary.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-06\ntags:\n - attack.execution\n - attack.t1059.006\n - attack.stealth\n - attack.t1620\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_proc:\n Image|endswith:\n - '\\python.exe'\n - '\\pythonw.exe'\n - '\\python3.exe'\n CommandLine|contains|all:\n - 'ctypes'\n - 'VirtualAlloc'\n condition: selection_proc\nfalsepositives:\n - Security research tools or CTF scripts using ctypes with VirtualAlloc in Python\n - Legitimate automation scripts performing memory-mapped operations via ctypes\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc9bd18a-3438-5bff-9528-974ac25dd306", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59409Z", "modified": "2026-10-01T19:54:15.59409Z", "name": "THL DETECT Cobalt Strike Malleable C2 MALC User-Agent Detected", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT Cobalt Strike Malleable C2 MALC User-Agent Detected\"; flow:established,to_server; http.user_agent; content:\"MALC)\"; endswith; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/open-directory-172-105-0-126-20260406-detections/; classtype:trojan-activity; sid:9001003; rev:4; metadata:author The_Hunters_Ledger, date 2026-04-06;)", "pattern_type": "suricata", "valid_from": "2026-04-06T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594172Z", "modified": "2026-10-01T19:54:15.594172Z", "name": "OpenStrike", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594248Z", "modified": "2026-10-01T19:54:15.594248Z", "name": "Cobalt Strike 3.x", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a9dd14e9-1489-5506-8c2a-6506599bf0a7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594422Z", "modified": "2026-10-01T19:54:15.594422Z", "name": "OpenStrike C beacon", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--89de73ed-b52f-5725-9b1d-e1485941fb23", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594501Z", "modified": "2026-10-01T19:54:15.594501Z", "name": "SEH-based shellcode loader - CreateThread", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--96ff8677-d043-52c2-8899-d2cb30ec3210", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594569Z", "modified": "2026-10-01T19:54:15.594569Z", "name": "VEH test harness", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--90fb547f-6228-5806-b83d-34707246b2f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594656Z", "modified": "2026-10-01T19:54:15.594656Z", "name": "Entry-point debugger", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--cff9d26f-f8d4-5313-8528-043475a6005e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594747Z", "modified": "2026-10-01T19:54:15.594747Z", "name": "Entry-point debugger - INT3 patch at CALL RAX", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--6b703025-d6f1-5db4-a869-8964b18fc04e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594831Z", "modified": "2026-10-01T19:54:15.594831Z", "name": "CS 3.x DLL beacon - MSVC 2012", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--aec206f6-a214-521a-9cbb-8d183a28eeef", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594898Z", "modified": "2026-10-01T19:54:15.594898Z", "name": "OpenStrike C beacon - custom C implant", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--47e0a832-3f46-50fe-aa4f-8bc536b4c9e2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.594963Z", "modified": "2026-10-01T19:54:15.594963Z", "name": "Minimal shellcode runner", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--0ad1531c-4abc-5f7d-8a28-7c0215096cd4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595025Z", "modified": "2026-10-01T19:54:15.595025Z", "name": "Minimal shellcode runner - bare VirtualAlloc+call", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--36a8dd21-b25b-50a6-bbdd-a4594c1041dc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595088Z", "modified": "2026-10-01T19:54:15.595088Z", "name": "Shellcode stager", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--945e6206-033e-51b2-8625-28479250bf55", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59515Z", "modified": "2026-10-01T19:54:15.59515Z", "name": "VEH test harness - reads C:\\cs_final.dat", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--65c134e0-c337-56b9-a2a0-06e2527e34ca", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595211Z", "modified": "2026-10-01T19:54:15.595211Z", "name": "SEH-based shellcode loader", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--24281894-85e3-5c9d-9c9a-131e761d1029", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595274Z", "modified": "2026-10-01T19:54:15.595274Z", "name": "Shellcode stager - downloads from /qz99", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595334Z", "modified": "2026-10-01T19:54:15.595334Z", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/006", "external_id": "T1059.006" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595437Z", "modified": "2026-10-01T19:54:15.595437Z", "name": "Windows Command Shell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/003", "external_id": "T1059.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595523Z", "modified": "2026-10-01T19:54:15.595523Z", "name": "Native API", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1106", "external_id": "T1106" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595601Z", "modified": "2026-10-01T19:54:15.595601Z", "name": "Shared Modules", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1129", "external_id": "T1129" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595678Z", "modified": "2026-10-01T19:54:15.595678Z", "name": "Reflective Code Loading", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1620", "external_id": "T1620" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595754Z", "modified": "2026-10-01T19:54:15.595754Z", "name": "Process Injection", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1055", "external_id": "T1055" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.595834Z", "modified": "2026-10-01T19:54:15.595834Z", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1027", "external_id": "T1027" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5f7c7e8c-d6e9-51b9-aafc-3d5e38915be2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59591Z", "modified": "2026-10-01T19:54:15.59591Z", "name": "Software Packing", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1027/002", "external_id": "T1027.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59599Z", "modified": "2026-10-01T19:54:15.59599Z", "name": "Deobfuscate/Decode Files or Information", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1140", "external_id": "T1140" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--42ac3607-42a1-50da-b92d-9f5aaba3f7bc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596067Z", "modified": "2026-10-01T19:54:15.596067Z", "name": "Debugger Evasion", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1622", "external_id": "T1622" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3e0f1033-d731-5b8e-8f4c-27484d52e4f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596142Z", "modified": "2026-10-01T19:54:15.596142Z", "name": "System Checks", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1497/001", "external_id": "T1497.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596217Z", "modified": "2026-10-01T19:54:15.596217Z", "name": "System Information Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596294Z", "modified": "2026-10-01T19:54:15.596294Z", "name": "File and Directory Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1083", "external_id": "T1083" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596369Z", "modified": "2026-10-01T19:54:15.596369Z", "name": "Process Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1057", "external_id": "T1057" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596446Z", "modified": "2026-10-01T19:54:15.596446Z", "name": "System Owner/User Discovery", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1033", "external_id": "T1033" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596525Z", "modified": "2026-10-01T19:54:15.596525Z", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1071/001", "external_id": "T1071.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596601Z", "modified": "2026-10-01T19:54:15.596601Z", "name": "Symmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1573/001", "external_id": "T1573.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5fd2d136-e0aa-561f-88f3-773754094103", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596676Z", "modified": "2026-10-01T19:54:15.596676Z", "name": "Asymmetric Cryptography", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1573/002", "external_id": "T1573.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0df81c9e-a792-5c47-a105-a83765880357", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596751Z", "modified": "2026-10-01T19:54:15.596751Z", "name": "Non-Standard Encoding", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1132/002", "external_id": "T1132.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59683Z", "modified": "2026-10-01T19:54:15.59683Z", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1105", "external_id": "T1105" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596908Z", "modified": "2026-10-01T19:54:15.596908Z", "name": "Exfiltration Over C2 Channel", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1041", "external_id": "T1041" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.596983Z", "modified": "2026-10-01T19:54:15.596983Z", "name": "Develop Capabilities: Malware", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1587/001", "external_id": "T1587.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--2b9bfc61-c816-5f97-8889-e2e260134cee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597064Z", "modified": "2026-10-01T19:54:15.597064Z", "name": "open-directory-172-105-0-126-20260406 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3df2ea89-01e3-5f45-8eb5-8fede1eb92c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597445Z", "modified": "2026-10-01T19:54:15.597445Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1efc2511-b3c2-52ad-9430-83c9f1ea91fb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597526Z", "modified": "2026-10-01T19:54:15.597526Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd0bcf12-1a25-53b5-9367-8701e3713583", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597593Z", "modified": "2026-10-01T19:54:15.597593Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23f90b26-d07e-59b0-9330-3ee451406507", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597657Z", "modified": "2026-10-01T19:54:15.597657Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--95964a5c-6272-5eb8-8fd5-a2c7256035e9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59772Z", "modified": "2026-10-01T19:54:15.59772Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f262a57-629f-5854-9576-e74e9319232e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597782Z", "modified": "2026-10-01T19:54:15.597782Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--594991c0-399c-57a9-a305-bc968163ae25", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597849Z", "modified": "2026-10-01T19:54:15.597849Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a35f46f-2ebb-5f82-94c0-bdad1ffa9650", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59791Z", "modified": "2026-10-01T19:54:15.59791Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--5f7c7e8c-d6e9-51b9-aafc-3d5e38915be2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--967b78cd-0997-5838-8bc3-1179fa625ad8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.597972Z", "modified": "2026-10-01T19:54:15.597972Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf802068-7ca5-563e-8cc9-a219a1b4071c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598036Z", "modified": "2026-10-01T19:54:15.598036Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--42ac3607-42a1-50da-b92d-9f5aaba3f7bc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2ae8c4e-0437-5aed-a4c3-f2645ca5dff7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598096Z", "modified": "2026-10-01T19:54:15.598096Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--3e0f1033-d731-5b8e-8f4c-27484d52e4f0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2753188f-e0f5-5b82-ae3b-5da3dd8d68cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598156Z", "modified": "2026-10-01T19:54:15.598156Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd324a6d-dc90-5a3c-ad4c-a4d1d5f89074", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598219Z", "modified": "2026-10-01T19:54:15.598219Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e63e9ea-8ab1-54b4-b2f7-e0d62da50a78", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598279Z", "modified": "2026-10-01T19:54:15.598279Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b07ac6c7-8267-56f2-916c-c89d444ab109", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598339Z", "modified": "2026-10-01T19:54:15.598339Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77945f7f-a7c8-574e-aacc-bbe4f4b14b09", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598398Z", "modified": "2026-10-01T19:54:15.598398Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c54f4038-95f6-5e8d-91e1-e31b605ac885", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598457Z", "modified": "2026-10-01T19:54:15.598457Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d7613fde-19a4-5a0e-b844-cddc180ff5f8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598516Z", "modified": "2026-10-01T19:54:15.598516Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--5fd2d136-e0aa-561f-88f3-773754094103", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a5c1b05-89d9-591b-b464-fbebf7f1a852", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598577Z", "modified": "2026-10-01T19:54:15.598577Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--0df81c9e-a792-5c47-a105-a83765880357", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec974e5c-57a8-5106-a3d4-1d47c15dc4f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598636Z", "modified": "2026-10-01T19:54:15.598636Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4874b389-ce85-5ed8-8f00-07ea81c74cb5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598696Z", "modified": "2026-10-01T19:54:15.598696Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c34a4bf7-3e18-55e7-ad77-f3d777f42699", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598755Z", "modified": "2026-10-01T19:54:15.598755Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cec071f8-5e55-555b-8ee5-2c0f21181f1b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598818Z", "modified": "2026-10-01T19:54:15.598818Z", "relationship_type": "uses", "source_ref": "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "target_ref": "infrastructure--2b9bfc61-c816-5f97-8889-e2e260134cee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be790830-ffd7-5161-a307-2d7d7efd0fe0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59888Z", "modified": "2026-10-01T19:54:15.59888Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd196d84-2deb-564a-980c-1246f5820959", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.598939Z", "modified": "2026-10-01T19:54:15.598939Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2f5e5be-0873-5889-a813-512534fbc4cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599001Z", "modified": "2026-10-01T19:54:15.599001Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c08c4780-dad4-51aa-aedb-fe792b290966", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59906Z", "modified": "2026-10-01T19:54:15.59906Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--681024e6-769f-5d06-9c08-284017ec3692", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599119Z", "modified": "2026-10-01T19:54:15.599119Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c81d10ac-660f-504b-a202-2ea058ce7250", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599177Z", "modified": "2026-10-01T19:54:15.599177Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f7d41ce-40bb-5976-b708-b7c1d41506c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599237Z", "modified": "2026-10-01T19:54:15.599237Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aca594e8-60ed-53c3-b052-caf9abcd5f3b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599298Z", "modified": "2026-10-01T19:54:15.599298Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--5f7c7e8c-d6e9-51b9-aafc-3d5e38915be2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77ecf14a-91d4-5c3f-ac81-3d5b8e26a404", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599358Z", "modified": "2026-10-01T19:54:15.599358Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0c04520-7d2f-535b-aeb1-9992fa2600de", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599418Z", "modified": "2026-10-01T19:54:15.599418Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--42ac3607-42a1-50da-b92d-9f5aaba3f7bc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee753501-8da0-518e-8491-520cc0c13436", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599477Z", "modified": "2026-10-01T19:54:15.599477Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--3e0f1033-d731-5b8e-8f4c-27484d52e4f0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--54063a11-5b5b-5c12-a813-3bff971726c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599536Z", "modified": "2026-10-01T19:54:15.599536Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cdef5f2-c7e0-522c-b737-5639e5751a27", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599595Z", "modified": "2026-10-01T19:54:15.599595Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--674d0b8c-9cc6-5630-b296-1d5ab73e41ca", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599654Z", "modified": "2026-10-01T19:54:15.599654Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4766dd7b-11ca-5d84-9139-8803828e8cc2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599712Z", "modified": "2026-10-01T19:54:15.599712Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25d58596-23c2-5d4c-9594-ac98741be863", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.59977Z", "modified": "2026-10-01T19:54:15.59977Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc30fd78-ba6a-55c2-9431-3c18a299341b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599833Z", "modified": "2026-10-01T19:54:15.599833Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91751db5-7534-5135-b533-131192c8c273", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599893Z", "modified": "2026-10-01T19:54:15.599893Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--5fd2d136-e0aa-561f-88f3-773754094103", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3bdd736-68f0-566d-baf4-ef132c6f8dd3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.599954Z", "modified": "2026-10-01T19:54:15.599954Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--0df81c9e-a792-5c47-a105-a83765880357", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4fa657db-f04b-5a9c-9b94-851b0bdf52ff", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.600014Z", "modified": "2026-10-01T19:54:15.600014Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--505885ba-68dc-502a-8d07-015bf6609a45", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.600072Z", "modified": "2026-10-01T19:54:15.600072Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32e1082c-9a36-53b2-b00d-2990c6e4338c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.600131Z", "modified": "2026-10-01T19:54:15.600131Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--795d5a44-a859-5bc3-8195-7340fdc3b6b4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.60019Z", "modified": "2026-10-01T19:54:15.60019Z", "relationship_type": "uses", "source_ref": "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "target_ref": "infrastructure--2b9bfc61-c816-5f97-8889-e2e260134cee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--275b389e-e02e-5042-8cc9-f20b55d10b10", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:15.600274Z", "modified": "2026-10-11T14:08:29.834217Z", "name": "OpenStrike Beacon Toolkit — Open Directory 172.105.0.126", "report_types": [ "threat-report" ], "published": "2026-04-06T00:00:00Z", "object_refs": [ "ipv4-addr--e35990fa-a64b-54ec-94be-6b82c22af8b3", "indicator--9427c028-4d29-5459-8d42-9d771bbc8bd1", "url--df2a41f8-6227-5cfe-90f7-abe3241f998b", "indicator--ae68ae51-a087-5162-9a0b-1d5aa6d808a2", "url--6e39bf1f-cf2f-5a07-9fcc-dc1397a14632", "indicator--600f0a6d-5076-5b30-9bef-18bf21175253", "url--b3738d8f-6d61-5a2f-8a84-6a0d8061457d", "indicator--9096b844-2259-5f22-ad82-ea8bf0c22dfc", "url--32127a8d-ae58-5229-a2ab-74ec48b0f0f2", "indicator--45d3b14f-1c2d-511a-9858-3d8ceed46319", "url--1ce48054-f232-5de8-b208-8299aaf81f74", "indicator--11d351db-d751-5512-a1f4-270bd25c082c", "file--4ad7c842-1c5e-55ae-8cd7-400b736196ed", "file--011631d8-4e2b-5ffb-b1c5-1c127b1dcae0", "file--1d84f28c-b742-504d-8ee6-2c6283729d90", "file--42981512-e89f-5ef4-abd3-8311508a914b", "file--4f7cc071-35e6-5025-9be1-0649ca1491d5", "file--1dbaad8b-e02e-5fea-8410-244842de022a", "file--e7fc303f-c25d-5bd6-9de5-4b7eb688784a", "file--64828200-59cb-5391-9a93-8a0c866dfa5e", "file--f2cae10d-f024-5c23-b42e-dc21950b58fd", "file--7e4eb8c9-cfc5-57fa-8799-3f4852698cfd", "file--72d52f02-4466-5a79-9639-d29a05ea2aff", "file--ff40f8bf-a4fa-5a7c-8b53-9e17229d3f9c", "file--2e736f29-2f82-5391-89b6-0316a571b095", "indicator--28ec31c3-407c-5b53-b1e4-c7e0cb6ae4ef", "indicator--de77065d-1422-50cc-9ac1-e9559067cd32", "indicator--c82deec6-386a-575b-81ce-c05c915ecc68", "indicator--bf8476f9-048b-55b3-91a6-8d3c92e66ca5", "indicator--0f6627e9-c513-5f19-bbb8-382993ac7595", "indicator--10f1abe9-6ea3-5972-81b7-118c20aa2908", "indicator--fc9bd18a-3438-5bff-9528-974ac25dd306", "malware--421b2b0d-5685-565c-9459-62c554dd9edb", "malware--fca8d0e7-6e2f-5581-a0cb-9c2a8a5f72ed", "tool--a9dd14e9-1489-5506-8c2a-6506599bf0a7", "tool--89de73ed-b52f-5725-9b1d-e1485941fb23", "tool--96ff8677-d043-52c2-8899-d2cb30ec3210", "tool--90fb547f-6228-5806-b83d-34707246b2f1", "tool--cff9d26f-f8d4-5313-8528-043475a6005e", "tool--6b703025-d6f1-5db4-a869-8964b18fc04e", "tool--aec206f6-a214-521a-9cbb-8d183a28eeef", "tool--47e0a832-3f46-50fe-aa4f-8bc536b4c9e2", "tool--0ad1531c-4abc-5f7d-8a28-7c0215096cd4", "tool--36a8dd21-b25b-50a6-bbdd-a4594c1041dc", "tool--945e6206-033e-51b2-8625-28479250bf55", "tool--65c134e0-c337-56b9-a2a0-06e2527e34ca", "tool--24281894-85e3-5c9d-9c9a-131e761d1029", "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "attack-pattern--46fef570-2355-5842-9d6c-54ae4cb649bd", "attack-pattern--a42fc6ae-4096-53e5-98d2-02c39a64d42c", "attack-pattern--755f0c17-280f-566e-a2da-282903887159", "attack-pattern--f2547d19-a04e-5945-ba6a-c96c6f509e67", "attack-pattern--f49f7ccf-9e42-5d58-aaa7-c46f34716f27", "attack-pattern--0e5a3749-a144-57b8-a774-20335f3f0941", "attack-pattern--5f7c7e8c-d6e9-51b9-aafc-3d5e38915be2", "attack-pattern--ba61986c-2ad8-5246-8fad-deba7ea471bd", "attack-pattern--42ac3607-42a1-50da-b92d-9f5aaba3f7bc", "attack-pattern--3e0f1033-d731-5b8e-8f4c-27484d52e4f0", "attack-pattern--a0baf777-47e7-57bb-a5f8-ffa4f9a1dbe8", "attack-pattern--7aaed457-e65a-5fce-9e83-3b3f1fcd78ce", "attack-pattern--b12dc527-38bd-5e3a-a077-afa4290df40b", "attack-pattern--d7349065-fabe-5ed1-9cf8-110367dd3c3e", "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "attack-pattern--88e2313f-cf2a-59dc-8124-88e46e53b1c4", "attack-pattern--5fd2d136-e0aa-561f-88f3-773754094103", "attack-pattern--0df81c9e-a792-5c47-a105-a83765880357", "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "attack-pattern--06cbe52b-abcb-5b54-a3ec-c553a82c7374", "attack-pattern--87b8e72a-5437-59a8-a6a9-16f846415a26", "infrastructure--2b9bfc61-c816-5f97-8889-e2e260134cee", "relationship--3df2ea89-01e3-5f45-8eb5-8fede1eb92c9", "relationship--1efc2511-b3c2-52ad-9430-83c9f1ea91fb", "relationship--bd0bcf12-1a25-53b5-9367-8701e3713583", "relationship--23f90b26-d07e-59b0-9330-3ee451406507", "relationship--95964a5c-6272-5eb8-8fd5-a2c7256035e9", "relationship--3f262a57-629f-5854-9576-e74e9319232e", "relationship--594991c0-399c-57a9-a305-bc968163ae25", "relationship--2a35f46f-2ebb-5f82-94c0-bdad1ffa9650", "relationship--967b78cd-0997-5838-8bc3-1179fa625ad8", "relationship--bf802068-7ca5-563e-8cc9-a219a1b4071c", "relationship--d2ae8c4e-0437-5aed-a4c3-f2645ca5dff7", "relationship--2753188f-e0f5-5b82-ae3b-5da3dd8d68cf", "relationship--fd324a6d-dc90-5a3c-ad4c-a4d1d5f89074", "relationship--8e63e9ea-8ab1-54b4-b2f7-e0d62da50a78", "relationship--b07ac6c7-8267-56f2-916c-c89d444ab109", "relationship--77945f7f-a7c8-574e-aacc-bbe4f4b14b09", "relationship--c54f4038-95f6-5e8d-91e1-e31b605ac885", "relationship--d7613fde-19a4-5a0e-b844-cddc180ff5f8", "relationship--3a5c1b05-89d9-591b-b464-fbebf7f1a852", "relationship--ec974e5c-57a8-5106-a3d4-1d47c15dc4f0", "relationship--4874b389-ce85-5ed8-8f00-07ea81c74cb5", "relationship--c34a4bf7-3e18-55e7-ad77-f3d777f42699", "relationship--cec071f8-5e55-555b-8ee5-2c0f21181f1b", "relationship--be790830-ffd7-5161-a307-2d7d7efd0fe0", "relationship--cd196d84-2deb-564a-980c-1246f5820959", "relationship--c2f5e5be-0873-5889-a813-512534fbc4cf", "relationship--c08c4780-dad4-51aa-aedb-fe792b290966", "relationship--681024e6-769f-5d06-9c08-284017ec3692", "relationship--c81d10ac-660f-504b-a202-2ea058ce7250", "relationship--9f7d41ce-40bb-5976-b708-b7c1d41506c9", "relationship--aca594e8-60ed-53c3-b052-caf9abcd5f3b", "relationship--77ecf14a-91d4-5c3f-ac81-3d5b8e26a404", "relationship--c0c04520-7d2f-535b-aeb1-9992fa2600de", "relationship--ee753501-8da0-518e-8491-520cc0c13436", "relationship--54063a11-5b5b-5c12-a813-3bff971726c9", "relationship--8cdef5f2-c7e0-522c-b737-5639e5751a27", "relationship--674d0b8c-9cc6-5630-b296-1d5ab73e41ca", "relationship--4766dd7b-11ca-5d84-9139-8803828e8cc2", "relationship--25d58596-23c2-5d4c-9594-ac98741be863", "relationship--fc30fd78-ba6a-55c2-9431-3c18a299341b", "relationship--91751db5-7534-5135-b533-131192c8c273", "relationship--d3bdd736-68f0-566d-baf4-ef132c6f8dd3", "relationship--4fa657db-f04b-5a9c-9b94-851b0bdf52ff", "relationship--505885ba-68dc-502a-8d07-015bf6609a45", "relationship--32e1082c-9a36-53b2-b00d-2990c6e4338c", "relationship--795d5a44-a859-5bc3-8195-7340fdc3b6b4" ], "labels": [ "Toolkit", "C2", "Open Dir", "Evasion" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/open-directory-172-105-0-126-20260406/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }