{
  "type": "bundle",
  "id": "bundle--2041982a-ba68-4b7c-801b-d38b2e021679",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Dispensight / SecureLeaf",
      "description": "Defensive CTI \u2014 secureleaf.dispensight.com",
      "identity_class": "organization"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "id": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omegatech cluster (AS202412 / AS197769 / AS219502)",
      "description": "Co-operated three-ASN cluster behind WP-001 credential-harvesting activity. AS202412 Omegatech (hub, Spamhaus DROP), AS197769 VPS Dedicated (buddy, co-timed announcements), AS219502 Storm Industries (3rd ring). On 2026-10-23, 10 source IPs \u2014 8 from Omegatech's own 130.12.180.0/24 and 91.92.240.0/24, 2 from the AS197769 buddy \u2014 scanned the Dispensight application tier DIRECTLY FROM ANNOUNCED ASN SPACE (not Cloudflare-fronted). Primary objective: exposed .env credential/secret files on the app subdomains (s01-app, kpi, help, taxii). The 130.12.180.0/24 pool is rotating fresh hosts (.175/.176 new this window).",
      "external_references": [
        {
          "source_name": "SecureLeaf",
          "external_id": "SL-ADV-2026-WP-001"
        }
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Exposed .env / credential-file harvesting",
      "description": "GET probes for /.env across application subdomains to disclose credentials/secrets.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.001"
        }
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--e360addd-0512-57a7-85f0-aac117bfe7e8",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "WordPress vulnerability enumeration",
      "description": "wlwmanifest.xml path-fuzzing fishing for a WordPress install (none present).",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1595.002"
        }
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b3ebfe13-82ce-56e9-962b-0d0f0daf31d5",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Public DB-admin panel probe",
      "description": "Probe for an exposed Adminer database panel (/admin/_adminer.php).",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190"
        }
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Active recon / login enumeration",
      "description": "Root (/) liveness probing and /login endpoint discovery against app subdomains.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1595.003"
        }
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b60691f-2b4a-5c30-93f4-225a11bdd97b",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster AS202412",
      "description": "AS202412 \u2014 tracked Omegatech cluster member.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[autonomous-system:number = 202412]",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "malicious-infrastructure"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--203d1ad9-c9fc-50fa-b540-8757add7b1ec",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster AS197769",
      "description": "AS197769 \u2014 tracked Omegatech cluster member.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[autonomous-system:number = 197769]",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "malicious-infrastructure"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f603c61-350c-5446-aec3-07633f8e673f",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster prefix 102.220.160.0/23 (AS197769)",
      "description": "Announced prefix sourcing offenders 2026-10-23 \u2014 AS197769. 130.12.180.0/24 is a durable, blockable direct-scan source.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '102.220.160.0/23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "malicious-infrastructure"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster prefix 130.12.180.0/24 (AS202412)",
      "description": "Announced prefix sourcing offenders 2026-10-23 \u2014 AS202412. 130.12.180.0/24 is a durable, blockable direct-scan source.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.0/24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "malicious-infrastructure"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f85b2ed-78f0-5fd3-8a40-bf74f5b92d9f",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster prefix 91.92.240.0/24 (AS202412)",
      "description": "Announced prefix sourcing offenders 2026-10-23 \u2014 AS202412. 130.12.180.0/24 is a durable, blockable direct-scan source.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '91.92.240.0/24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "malicious-infrastructure"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1355df9-0c13-56dd-bd8e-026032c19378",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 102.220.160.173 (AS197769)",
      "description": "AS197769 (VPS Dedicated (buddy)), prefix 102.220.160.0/23. 9 req(s) vs s01-app.dispensight.ca on 2026-10-22. Target: /web/wp-includes/wlwmanifest.xml, /wp-includes/wlwmanifest.xml, /website/wp-includes/wlwmanifest.xml.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '102.220.160.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "wp-enum"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36abd75f-50ed-54bc-99fc-3490ff286968",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 102.220.161.89 (AS197769)",
      "description": "AS197769 (VPS Dedicated (buddy)), prefix 102.220.160.0/23. 2 req(s) vs help.dispensight.cloud, taxii.dispensight.ca:443 on 2026-10-22. Target: root/liveness recon.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '102.220.161.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "recon"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94433ff6-8239-50c4-b6e6-637109fdd149",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.163 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 1 req(s) vs s01-app.dispensight.ca on 2026-10-23. Target: root/liveness recon.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "recon"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30c06d40-7d84-57ca-8770-ffc6c64cecd9",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.164 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 1 req(s) vs kpi.dispensight.ca on 2026-10-23. Target: /login.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "recon"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b82b8c5f-7a0e-52d0-9fb2-40c341dfd839",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.165 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 3 req(s) vs help.dispensight.cloud, kpi.dispensight.ca, s01-app.dispensight.ca on 2026-10-23. Target: /.env.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "env-harvest"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d501cf79-264e-506d-9eae-12b695e6d6c8",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.170 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 1 req(s) vs help.dispensight.cloud on 2026-10-23. Target: root/liveness recon.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "recon"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c358b11c-ae23-5d03-b359-20b573853285",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.171 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 1 req(s) vs help.dispensight.cloud on 2026-10-23. Target: /.env.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "env-harvest"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d868be4-a147-57e4-9d96-f20e652ac7fb",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.175 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 3 req(s) vs kpi.dispensight.ca, taxii.dispensight.ca on 2026-10-23. Target: /.env.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "env-harvest"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf3c8d1c-6b62-5896-8f3d-473a2232fbd8",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 130.12.180.176 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 130.12.180.0/24. 1 req(s) vs s01-app.dispensight.ca on 2026-10-23. Target: /.env.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '130.12.180.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "env-harvest"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df709983-921f-58bc-be03-42dee771dcbf",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "name": "Omega-cluster offender 91.92.240.200 (AS202412)",
      "description": "AS202412 (Omegatech), prefix 91.92.240.0/24. 1 req(s) vs dispensight.com on 2026-10-22. Target: /admin/_adminer.php.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '91.92.240.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-10-23T22:54:00Z",
      "labels": [
        "scanning",
        "adminer"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "note",
      "spec_version": "2.1",
      "id": "note--c13e0256-4918-50cd-8ad0-b92758675d13",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "abstract": "Targeted endpoints \u2014 Dispensight application tier",
      "content": "Cluster targeted the app subdomains, not the marketing site. Hosts hit: s01-app.dispensight.ca (4); help.dispensight.cloud (4); kpi.dispensight.ca (3); taxii.dispensight.ca:443 (1); taxii.dispensight.ca (1); dispensight.com (1). Primary offending paths: /.env (x4, across s01-app/kpi/help/taxii), WordPress wlwmanifest.xml enumeration, /admin/_adminer.php, /login. Objective: credential/secret disclosure via exposed .env.",
      "object_refs": [
        "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
        "indicator--b1355df9-0c13-56dd-bd8e-026032c19378",
        "indicator--36abd75f-50ed-54bc-99fc-3490ff286968",
        "indicator--94433ff6-8239-50c4-b6e6-637109fdd149",
        "indicator--30c06d40-7d84-57ca-8770-ffc6c64cecd9",
        "indicator--b82b8c5f-7a0e-52d0-9fb2-40c341dfd839",
        "indicator--d501cf79-264e-506d-9eae-12b695e6d6c8",
        "indicator--c358b11c-ae23-5d03-b359-20b573853285",
        "indicator--5d868be4-a147-57e4-9d96-f20e652ac7fb",
        "indicator--cf3c8d1c-6b62-5896-8f3d-473a2232fbd8",
        "indicator--df709983-921f-58bc-be03-42dee771dcbf"
      ],
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39f44c55-8b0d-5900-bfed-75e99c474dc6",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--b1355df9-0c13-56dd-bd8e-026032c19378",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bc8d388-183b-532d-b049-18795c2a8014",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--b1355df9-0c13-56dd-bd8e-026032c19378",
      "target_ref": "indicator--3f603c61-350c-5446-aec3-07633f8e673f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15f65624-bde2-5443-88b1-d5497f5e8eb8",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--b1355df9-0c13-56dd-bd8e-026032c19378",
      "target_ref": "attack-pattern--e360addd-0512-57a7-85f0-aac117bfe7e8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ee8779a-3761-5e05-a9fd-c461f093951d",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--36abd75f-50ed-54bc-99fc-3490ff286968",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0deae21a-3f45-5835-b3b1-0ba6b3cbeca6",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--36abd75f-50ed-54bc-99fc-3490ff286968",
      "target_ref": "indicator--3f603c61-350c-5446-aec3-07633f8e673f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd480b04-8784-540b-9b39-3558ecdaa26c",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--36abd75f-50ed-54bc-99fc-3490ff286968",
      "target_ref": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94848a1b-4eca-5c96-ae1c-6bb07787cc12",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--94433ff6-8239-50c4-b6e6-637109fdd149",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a338e6ff-0df9-5ac4-afaa-6ac7b69fcba5",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--94433ff6-8239-50c4-b6e6-637109fdd149",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb93aa8c-d83d-5d76-a343-03b6264cbb99",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--94433ff6-8239-50c4-b6e6-637109fdd149",
      "target_ref": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a0e27dc-9226-5359-8a3e-0e3bf7d88b4b",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--30c06d40-7d84-57ca-8770-ffc6c64cecd9",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be8974e1-6137-5664-b2b4-959f38a33a34",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--30c06d40-7d84-57ca-8770-ffc6c64cecd9",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8503eb1e-2e47-57a6-9cad-e8ac7808a24c",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--30c06d40-7d84-57ca-8770-ffc6c64cecd9",
      "target_ref": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf3802f2-5385-5ea6-ac6c-21297ca2b220",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--b82b8c5f-7a0e-52d0-9fb2-40c341dfd839",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f4b4740-0de3-5fcd-a883-1c5e44d26f7d",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--b82b8c5f-7a0e-52d0-9fb2-40c341dfd839",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--522b9a88-8328-5f8a-8cc6-e395bc014176",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--b82b8c5f-7a0e-52d0-9fb2-40c341dfd839",
      "target_ref": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71d7cce0-40af-5704-a0b7-a3533381e258",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--d501cf79-264e-506d-9eae-12b695e6d6c8",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb8c9615-4d94-5eff-a5e9-71016283e789",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--d501cf79-264e-506d-9eae-12b695e6d6c8",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df6ca4bd-b787-5f09-9421-8054f36b189f",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--d501cf79-264e-506d-9eae-12b695e6d6c8",
      "target_ref": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccb6dae6-f133-5cf2-9086-55cd7294a819",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--c358b11c-ae23-5d03-b359-20b573853285",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dddd62f4-55c8-57d7-b5f9-563436ca2eeb",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--c358b11c-ae23-5d03-b359-20b573853285",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a6ff9da-1332-5628-b226-9a0110d189c9",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--c358b11c-ae23-5d03-b359-20b573853285",
      "target_ref": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bca153df-8549-5aac-9d54-dd549a5552f1",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--5d868be4-a147-57e4-9d96-f20e652ac7fb",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b28249c-8582-587f-9618-8d86c81042a0",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--5d868be4-a147-57e4-9d96-f20e652ac7fb",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f7fde8-2d70-56ea-b99d-d8247ac06d20",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--5d868be4-a147-57e4-9d96-f20e652ac7fb",
      "target_ref": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6607b777-2154-5cff-b56e-cca86a423a35",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--cf3c8d1c-6b62-5896-8f3d-473a2232fbd8",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c380133-ada6-58d6-8d02-151fcf98ed56",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--cf3c8d1c-6b62-5896-8f3d-473a2232fbd8",
      "target_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47de4151-08d8-5314-ab4b-0f2abf3127ce",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--cf3c8d1c-6b62-5896-8f3d-473a2232fbd8",
      "target_ref": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c615001-a8ab-5baa-b2c5-3e0080a89d35",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "indicates",
      "source_ref": "indicator--df709983-921f-58bc-be03-42dee771dcbf",
      "target_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--886e9894-2ea3-514b-93bd-9c8f137dab3a",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--df709983-921f-58bc-be03-42dee771dcbf",
      "target_ref": "indicator--7f85b2ed-78f0-5fd3-8a40-bf74f5b92d9f",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--753be6f6-8f7c-5c2d-bb3a-b9b58f3c3a98",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--df709983-921f-58bc-be03-42dee771dcbf",
      "target_ref": "attack-pattern--b3ebfe13-82ce-56e9-962b-0d0f0daf31d5",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff3a3f00-c733-53d7-aa5a-b059b14f2125",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--3f603c61-350c-5446-aec3-07633f8e673f",
      "target_ref": "indicator--203d1ad9-c9fc-50fa-b540-8757add7b1ec",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--826d79e6-a5ab-5c61-b0c1-c47196f37de7",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--0aacadbe-aea4-580c-8f1c-0d946bbd549f",
      "target_ref": "indicator--9b60691f-2b4a-5c30-93f4-225a11bdd97b",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be2faaaa-cab1-50d0-88bb-0fc7b7e46aca",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--7f85b2ed-78f0-5fd3-8a40-bf74f5b92d9f",
      "target_ref": "indicator--9b60691f-2b4a-5c30-93f4-225a11bdd97b",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f01eb802-ec6f-5059-9b53-71738c5bef21",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "target_ref": "attack-pattern--43fbe23e-a121-544b-9ff2-ea4cfefcb760",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2057a9d3-ae85-5101-bb7b-2e316c96846d",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "target_ref": "attack-pattern--e360addd-0512-57a7-85f0-aac117bfe7e8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc1fc95e-73b7-53d0-81ab-36ea95e7bde0",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "target_ref": "attack-pattern--b3ebfe13-82ce-56e9-962b-0d0f0daf31d5",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fab141a-d6f8-5ee6-8b98-2c916e663e6e",
      "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
      "created": "2026-10-23T22:54:00.000Z",
      "modified": "2026-10-23T22:54:00.000Z",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--4c54f6ae-58d6-54f3-8456-eab87f416a98",
      "target_ref": "attack-pattern--0012034b-2a2d-53a5-8a4c-f9fe05f515c8",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ]
    }
  ]
}