Replace with new image

* Update snake.md

Updated malware behaviors and descriptions.

* Update snake.md

Divided table to split out enhanced techniques

* Update software-packing.md

Added Snake

* Update self-deletion.md

Added Snake

* Update system-information-discovery.md

Added Snake

* Update keylogging.md

Added Snake

* Update screen-capture.md

* Update decode-data.md

Added Snake

* Update decrypt-data.md

Added Snake

* Update copy-file.md

Added Snake

* Update create-file.md

Added Snake

* Update delete-file.md

* Update crypto-library.md

Added Snake

* Update crypto-library.md

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

anti-behavioral-analysis/virtual-machine-detection.md

@@ -17,7 +17,7 @@
 </tr>
 <tr>
 <td><b>Version</b></td>
-<td><b>2.3</b></td>
+<td><b>2.4</b></td>
 </tr>
 <tr>
 <td><b>Created</b></td>
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>27 April 2024</b></td>
+<td><b>27 December 2024</b></td>
 </tr>
 </table>
 
@@ -59,6 +59,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
 |**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
 |**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
+|**Check Username or Hostname**|B0009.039|Malware checks for hostnames or session usernames that indicate the use of a virtual machine.|
 |**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
 |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|

anti-static-analysis/disassembler-evasion.md

@@ -17,7 +17,7 @@
 </tr>
 <tr>
 <td><b>Version</b></td>
-<td><b>2.2</b></td>
+<td><b>2.3</b></td>
 </tr>
 <tr>
 <td><b>Created</b></td>
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>22 August 2024</b></td>
+<td><b>27 December 2024</b></td>
 </tr>
 </table>
 
@@ -41,6 +41,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
 |**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
 |**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
 |**Fake Function**|B0012.007|A fake function call is used to call an address which confuses a disassembler and results in incorrect disassembly. Manually undefining the function call can enable the disassembler to produce the true code.|
+|**pusha/popa Sequence**|B0012.008|Malware uses excessive pusha and popa instructions to confuse disassemblers.|
 |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
 |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
 

anti-static-analysis/software-packing.md

@@ -63,6 +63,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS.  [[6]](#6)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake is distributed in a packed format. [[9]](#9)|
 
 ## Detection
 
@@ -88,6 +89,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)|--|
 |[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)|--|
 |[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)|--|
+|[packed with nmm-protect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nmm-protect/packed-with-nmm-protect.yml)|Software Packing::VMProtect (F0001.010)|--|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|
@@ -134,3 +136,5 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 
 <a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
 
+<a name="9">[9]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/keylogging.md

@@ -56,6 +56,7 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
 |[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|F0002.001|Malware logs keystrokes via application hook. [[10]](#10)|
 
 ## Detection
 
@@ -104,3 +105,5 @@ setnz   al      ; if the previous condition is not met (the zero flag is 1), a 1
 
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="10">[10]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

collection/screen-capture.md

@@ -49,6 +49,7 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Malware captures screenshots. [[6]](#6)|
 
 ## Detection
 
@@ -96,3 +97,5 @@ call    dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rec
 
 <a name="5">[5]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="6">[6]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

defense-evasion/disable-or-evade-security-tools.md

@@ -67,6 +67,7 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
 |[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
 |[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|--|
 |[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)|--|
+|[overwrite DLL .text section to remove hooks](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml)|Disable or Evade Security Tools (F0004)|GetModuleHandle, GetModuleHandleEx|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|

defense-evasion/hijack-execution-flow.md

@@ -71,7 +71,7 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--|
-|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|CallWindowProc, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumProps, EnumPropsEx, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|AddPropSheetPageProc, CallWindowProc, CertEnumSystemStore, CertEnumSystemStoreLocator, CreateTimerQueueTimer, CryptEnumOIDInfo, DPA_Create, DPA_SetPtr, DPA_EnumCallback, DSA_Create, DSA_InsertItem, DSA_EnumCallback, DrawState, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, ImmEnumInputContext, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumDirTree, EnumDisplayMonitors, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumLanguageGroupLocales, GetDC, GetDCEx, EnumObjects, EnumProps, EnumPropsEx, EnumPwrSchemes, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemGeoNames, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumWindowsStations, EnumerateLoadedModules, EnumTimeFormats, SymInitialize, SymEnumProcesses, SymRegisterCallback, VerifierEnumerateResource|
 |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
 
 |Tool: CAPE|Mapping|APIs|

defense-evasion/self-deletion.md

@@ -48,13 +48,14 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
 |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake can delete itself. [[5]](#5)|
 
 ## Detection
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--|
-|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle|
+|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle, kernel32.SetFileInformationByHandle|
 
 |Tool: CAPE|Mapping|APIs|
 |---|---|---|
@@ -71,3 +72,5 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 <a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
 
 <a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
+
+<a name="5">[5]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

discovery/system-information-discovery.md

@@ -62,6 +62,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
 |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake gets the OS version, disk size, machine name, and geographic location [[11]](#11)|
 
 ## Detection
 
@@ -135,3 +136,5 @@ call    dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW]     ; call function
 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
 <a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="11">[11]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/communication/socket-communication.md

@@ -82,6 +82,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
 |[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, sendto, WSASend, WSASendTo, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
 |[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, WSARecv, WSARecvDisconnect, WSARecvFrom, recvmsg, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
+|[attach BPF to socket on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/socket/attach-bpf-to-socket-on-linux.yml)|Socket Communication::Set Socket Config (C0001.001)|setsockopt|
 
 |Tool: CAPE|Class|Mapping|APIs|
 |---|---|---|---|

micro-behaviors/cryptography/crypto-library.md

@@ -37,6 +37,12 @@ Malware uses a crypto library.
 |**API Call**|C0059.001|Malware uses crypto API calls.|
 |**Static Public Library**|C0059.002|A public crypto library is embedded in the code.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0059.001|Snake uses API calls to interface with cryptographic libraries. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
@@ -46,3 +52,7 @@ Malware uses a crypto library.
 |[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--|
 |[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--|
 |[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/cryptography/decrypt-data.md

@@ -55,6 +55,8 @@ Malware may decrypt data.
 |---|---|---|---|
 |[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
 |[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.001|Decrypts credential stores using AES [[2]](#2)|
+|[**Snake**](../../xample-malware/snake.md)|2004|C0031.005|Decrypts .NET assembly with 3DES [[2]](#2)|
 
 ## Detection
 
@@ -129,3 +131,5 @@ retn
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/data/compress-data.md

@@ -34,6 +34,7 @@ Malware may compress data.
 
 |Name|ID|Description|
 |---|---|---|
+|**aPLib**|C0024.003|Malware compresses data using aPLib.|
 |**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.|
 |**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.|
 

micro-behaviors/data/decode-data.md

@@ -36,3 +36,13 @@ Malware may decode data.
 |---|---|---|
 |**Base64**|C0053.001|Malware may decode data using base64.|
 |**XOR**|C0053.002|Malware may use XOR to decode data.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../xample-malware/snake.md)|2004|C0053.001|Snake decodes data stored in base64 during the unpacking process [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

micro-behaviors/file-system/copy-file.md

@@ -40,6 +40,7 @@ Malware copies a file.
 |[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
 |[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)|
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake copies files. [[2]](#2)|
 
 ## Detection
 
@@ -55,3 +56,5 @@ Malware copies a file.
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/create-file.md

@@ -37,6 +37,12 @@ Malware creates a file.
 |**Create Office Document**|C0016.001|An Office document is created.|
 |**Create Ransomware File**|C0016.002|Create a file used by ransomware.|
 
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake creates files. [[1]](#1)|
+
 ## Detection
 
 |Tool: capa|Mapping|APIs|
@@ -71,3 +77,8 @@ Malware creates a file.
 |[stack_pivot_file_created](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/stack_pivot.py)|StackPivotFileCreated|Create File (C0016)|NtCreateFile|
 |[masslogger_files](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/infostealer_masslogger.py)|MassLoggerFiles|Create File (C0016)|--|
 |[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|StealthFile|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+

micro-behaviors/file-system/delete-file.md

@@ -47,6 +47,7 @@ Malware deletes a file.
 |[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
 |[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
 |[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
+|[**Snake**](../../xample-malware/snake.md)|2004|--|Snake deletes files. [[2]](#2)|
 
 ## Detection
 
@@ -84,3 +85,6 @@ sbb     eax, eax        ; isolate the carry flag from the previous comparison.
 
 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
 
+<a name="2">[2]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+

revoked.md

@@ -0,0 +1,10 @@
+# Revoked Behaviors and Methods
+The Malware Behavior Catalog has revoked a small number of behaviors and methods as it has evolved.  The IDs for revoked behaviors and methods are not re-used.  If it appears that we are missing behavior or methods IDs, this page will explain what revoked IDs previously represented, when they were retired, and the reason for retiring them.
+
+| Revoked ID | Behavior or Method | Revocation Date | Reason |
+|--- |--- |--- |--- |
+| C0013 | UDP Communication | 25 September 2020 | Merged into C0001 because UDP also communicates over socket interfaces |
+| B0001.007 | Interrupt 1 | 2 August 2022 | Merged into B0001.006 to create a more general 'Interruption' method |
+| B0012.004 | Variable Recomposition | 21 November 2022 | Moved to B0032.021 |
+| C0032.004 | Verhoeff | 1 February 2023 | Not actually used in malware |
+| E1608 | Install Certificate | 14 February 2024 | Changed from enhanced ATT&CK technique ID (E-prefix) to enhanced ATT&CK sub-technique ID (F-prefix).  Current ID is F0016 |

xample-malware/snake.md

@@ -9,7 +9,7 @@
 </tr>
 <tr>
 <td><b>Aliases</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 <tr>
 <td><b>Platforms</b></td>
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Associated ATT&CK Software</b></td>
-<td><b>None</b></td>
+<td><b>Uroburos</b></td>
 </tr>
 </table>
 
@@ -30,12 +30,36 @@
 
 The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1)
 
+## ATT&CK Techniques
+
+See ATT&CK: [Uroburos](https://attack.mitre.org/software/S0022/)
+
+## Enhanced ATT&CK Techniques
+
+|Name|Use|
+|---|---|
+|[Anti-Static Analysis::Software Packing (F0001)](../anti-static-analysis/software-packing.md)| The Snake malware is distributed in a packed format [[1]](#1)|
+|[Anti-Static Analysis::Software Packing::Confuser (F0001.009)](../anti-static-analysis/software-packing.md)| Some analyzed Snake samples have been packed with Confuser [[2]](#2)|
+|[Defense Evasion::Self-Deletion (F0007)](../defense-evasion/self-deletion.md)| Snake can delete itself to prevent detection. [[1]](#1)|
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)| Snake collects information about the host on which it is running and its probable geographic location. [[1]](#1)|
+|[Collection::Keylogging::Application Hook (F0002.001)](../collection/keylogging.md)| Snake uses SetWindowsHookExA to monitor for and log keystrokes. [[1]](#1)|
+|[Collection::Screen Capture (E1113)](../collection/screen-capture.md)| Snake captures screenshots. [[1]](#1)|
+
 ## MBC Behaviors
 
 |Name|Use|
 |---|---|
-|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md)| Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+|[Data::Decode Data::Base64 (C0053.001)](../micro-behaviors/data/decode-data.md)| Snake decodes information stored in base64 during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::3DES (C0031.005)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts a .NET assembly encrypted with 3DES during the unpacking process observed in [[1]](#1)|
+|[Cryptography::Decrypt Data::AES (C0031.001)](../micro-behaviors/cryptography/decrypt-data.md)| Snake decrypts credentials stored in web browsers using AES. [[1]](#1)|
+|[File System::Copy File (C0045)](../micro-behaviors/file-system/copy-file.md)| Snake copies its executable to another location while establishing persistence. [[1]](#1)|
+|[File System::Create File (C0016)](../micro-behaviors/file-system/create-file.md)| Snake creates a scheduled task configuration file [[1]](#1)|
+|[File System::Delete File (C0047)](../micro-behaviors/file-system/delete-file.md)| Snake can delete image files created when screenshots are captured. [[1]](#1)|
+|[Cryptography::Crypto Library::API Call (C0059.001)](../micro-behaviors/cryptography/crypto-library.md)| Snake uses the Network Security Services library to decrypt some credentials stored in browsers. [[1]](#1)|
 
 ## References
 
 <a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
+
+<a name="2">[2]</a> https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/

yfaq/references_to_mbc.md

@@ -1,21 +1,36 @@
 # MBC in the Wild
 
-The following table contains community references to MBC:
+The following table lists papers and presentations that reference MBC.
 
 | Date | Reference |
 |------|-----------|
-| Aug 2022 | AccidentalRebel, “Talking about Mitre's Malware Behavior Catalog” Blackhat Middle East & Africa community meetup lightning talk, 2022. https://www.accidentalrebel.com/talking-about-mitres-malware-behavior-catalog.html   |
-| Dec 2021 | L.F. Martin, “PIFMANA: Pipeline for Malware Analysis,” Master Thesis, Universitat Oberta de Catalunya, 2021.                                                                                                                |
-| Dec 2021 | K. Oosthoek and C. Doerr, "Inside the Matrix: CTI Frameworks as Partial Abstractions of Complex Threats," 2021 IEEE International Conference on Big Data (Big Data), 2021.                                                  |
-| Dec 2021 | M. R. Smith et al., "Malware Generation with Specific Behaviors to Improve Machine Learning-based Detection," 2021 IEEE International Conference on Big Data (Big Data), 2021.                                              |
-| Nov 2021 | K. Licudine, Blackhat Middle East community meetup presentation. https://www.linkedin.com/posts/juan-karlo-licudine_malware-community-middleeast-activity-6958155280530456576-UUlb/                                         |
-| Nov 2021 | F. Bilstein, “Capability Analysis of Malicious Software,” Universitat Bonn, Nov 2021 (advisor: Daniel Plohmann, Malpedia)                                                                                                   |
+| May 2024 | M. Beninger et al, “ERSO: Enhancing Military Cybersecurity with AI-Driven SBOM for Firmware Vulnerability Detection and Asset Management,” CyCon 2024. https://ccdcoe.org/uploads/2024/05/CyCon_2024_Beninger_Charland_Ding_Fung-1.pdf ​|
+| Apr 2024 | A. Nadeem, “Understanding Adversary Behavior via XAI: Leveraging Sequence Clustering To Extract Threat Intelligence,” Thesis, TU Delft. https://research.tudelft.nl/en/publications/understanding-adversary-behavior-via-xai-leveraging-sequence-clus ​|
+| Mar 2024 | A. Nair and G. Ramesh, “Ontology-Driven Behavioral Model for Ransomware Traceability.” https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4779064 ​|
+| Jan 2024 | A. Ruggia, “Unmasking the Veiled: A Comprehensive Analysis of Android Evasive Malware.” ​https://hal.science/hal-04378941/ |
+| Dec 2023 | D. Sim et al, “A SIEM and Multiple Analysis Software Integrated Malware Detection Approach.” https://ieeexplore.ieee.org/abstract/document/10425463 ​|
+| Aug 2023 | J. Liu et al, “MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network.” https://link.springer.com/article/10.1186/s42400-023-00157-w ​|
+| Jul 2023​ | D. Beck, “Malware Behavior Catalog,” Poster at 14th Annual Malware TEM, Lawrence Livermore National Laboratory, 25-26 July 2023.​ |
+| Mar 2023​ | M. Smith et al, “All Models are Wrong, but Some(times) are Useful: Evaluating when Machine Learning Models are Useful for Detecting Novel Malware in the Wild,” Sandia NL, 2022. https://www.osti.gov/servlets/purl/2005426​ |
+| Mar 2023​ | S. Kumari, “TRY HACK ME: Basic Static Analysis Write-Up,” Medium, 3/13/2023. https://medium.com/@kumarishefu.4507/try-hack-me-basic-static-analysis-write-up-500b0e23792d ​|
+| Feb 2023​ | L. Zeltser, “SANS DFIR Malware Analysis Tips and Tricks Poster.” https://www.sans.org/posters/malware-analysis-tips-tricks-poster/ ​|
+| Oct 2022​ | M. Smith, “MalGen: Malware Generation with Specific Behaviors to Improve Machine Learning-based Detectors.” https://www.osti.gov/biblio/1893244 ​|
+| Sep 2022 | R. Marinho et al, ”Introdução à Análise de Códigos Maliciosos para ambiente Windows.” https://sol.sbc.org.br/livros/index.php/sbc/catalog/download/107/479/752-1 ​|
+| Aug 2022 | AccidentalRebel, “Talking about Mitre's Malware Behavior Catalog” Blackhat Middle East & Africa community meetup lightning talk, 2022. https://www.accidentalrebel.com/talking-about-mitres-malware-behavior-catalog.html |
+| Jul 2022​ | K. Licudine, “MBCScan,” scans a file for MBC behaviors. https://github.com/accidentalrebel/mbcscan ​|
+| May 2022​ | “Hackers-Tools.” https://github.com/Willian-2-0-0-1/Hacker-s-Tools-/blob/main/README.md ​|
+| Dec 2021 | L.F. Martin, “PIFMANA: Pipeline for Malware Analysis,” Master Thesis, Universitat Oberta de Catalunya, 2021. |
+| Dec 2021 | K. Oosthoek and C. Doerr, "Inside the Matrix: CTI Frameworks as Partial Abstractions of Complex Threats," 2021 IEEE International Conference on Big Data (Big Data), 2021. |
+| Dec 2021 | M. R. Smith et al., "Malware Generation with Specific Behaviors to Improve Machine Learning-based Detection," 2021 IEEE International Conference on Big Data (Big Data), 2021. |
+| Nov 2021 | K. Licudine, Blackhat Middle East community meetup presentation. https://www.linkedin.com/posts/juan-karlo-licudine_malware-community-middleeast-activity-6958155280530456576-UUlb/ |
+| Nov 2021 | F. Bilstein, “Capability Analysis of Malicious Software,” Universitat Bonn, Nov 2021 (advisor: Daniel Plohmann, Malpedia) |
 | Oct 2021 | M. M. Islam, A. Dutta, M. S. I. Sajid, E. Al-Shaer, J. Wei and S. Farhang, "CHIMERA: Autonomous Planning and Orchestration for Malware Deception," 2021 IEEE Conference on Communications and Network Security (CNS), 2021. |
-| Sep 2021 | D. Beck, “Malware Behavior Catalog,” DoD/NNSA SwA CoP 2021, Sept 2021.                                                                                                                                                      |
-| Jul 2021 | N. Johnson, “Going Beyond Signature Malware Detection by Learning Behaviors,” Sandia. SAND2021-8104C.                                                                                                                       |
-| Nov 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” AISec ’20, 13 Nov 2020.                                                                                   |
-| Oct 2020 | D. Beck, “Standardized Reporting with MBC,” VB2020 localhost                                                                                                                                                                |
-| May 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” arXivLabs, May 2020.                                                                                      |
-| Oct 2019 | D. Beck, “Malware Behavior Catalog,” BSidesDC, Oct 2019.                                                                                                                                                                    |
-| Jul 2019 | D. Beck, “Malware Behavior Catalog,” MTEM, July 2019.                                                                                                                                                                       |
-| Jun 2019 | K. O’Meara, “Behavioral Matrix and Tool Analysis of Energetic Bear and GreyEnergy Actor,” SEI CERT Coordination Center, June 2019.                                                                                          |
+| Sep 2021 | D. Beck, “Malware Behavior Catalog,” DoD/NNSA SwA CoP 2021, Sept 2021. |
+| Jul 2021 | N. Johnson, “Going Beyond Signature Malware Detection by Learning Behaviors,” Sandia. SAND2021-8104C. |
+| Apr 2021​ | K. Licudine, “mbclib,” library for querying the STIX data for MBC. https://pypi.org/project/mbclib/#description ​|
+| Nov 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” AISec ’20, 13 Nov 2020. |
+| Oct 2020 | D. Beck, “Standardized Reporting with MBC,” VB2020 localhost.   |
+| May 2020 | M.R. Smith et al, “Mind the Gap: On Bridging the Semantic Gap between Machine Learning and Information Security,” arXivLabs, May 2020. |
+| Oct 2019 | D. Beck, “Malware Behavior Catalog,” BSidesDC, Oct 2019.  |
+| Jul 2019 | D. Beck, “Malware Behavior Catalog,” MTEM, July 2019.  |
+| Jun 2019 | K. O’Meara, “Behavioral Matrix and Tool Analysis of Energetic Bear and GreyEnergy Actor,” SEI CERT Coordination Center, June 2019. |

yvisualization/README.md

@@ -0,0 +1,103 @@
+# Malware Behavior Visualization
+
+We investigated the [STIX Visualizer (STIXviz)](https://github.com/oasis-open/cti-stix-visualization) and the [Attack Flow Builder (AFB)](https://github.com/center-for-threat-informed-defense/attack-flow) for visualizing malware behaviors as defined by MBC and ATT&CK. We assume the reader is familiar with [Structured Threat Information Expression (STIX)](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html) (a language and serialization format used to exchange cyber threat intelligence) and [Attack Flow](https://github.com/center-for-threat-informed-defense/attack-flow) (a language for describing how cyber adversaries combine and sequence offensive techniques to achieve their goals).
+
+**Choosing between STIXviz and AFB**
+
+The STIXviz user interface is more advanced than AFB's, so if STIX content is available or easy for the user to generate, STIXviz may be the better option. However, creating a behavior graph when a STIX representation is not available is much easier with AFB. 
+
+Other considerations:
+- Both tools offer unique advantages and may be best used in combination. 
+- Capturing temporal flow/chronology is easy in AFB (AFB was designed for "flows").
+- AFB relationships are very basic compared to STIX Relationship Objects (SROs).
+- For someone familiar with STIX, building a graph in AFB may take more time than generating STIX.
+- AFB can be used as a tool for generating STIX. The AFB "Publish Attack Flow" option produces a STIX bundle. The resulting JSON output is not fully aligned with STIX (for example, STIX Relationship Objects are missing) but the output is a good start and can be displayed in STIXviz. 
+
+## Example Behavior Graphs 
+
+**IcedID**
+
+- [Source blog](https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise)
+- [AFB graph](./attack-flow-builder/icedid/IcedID-032725.png) (image)
+- [STIX graph](./stix-visualizer/icedid/icedid-viz.png) (image)
+- [.afb file](./attack-flow-builder/icedid/IcedID-032725.afb) (loadable into AFB)
+- [STIX JSON file](./stix-visualizer/icedid/icedid-stix.json) (loadable into STIXviz)
+
+**Lactrodectus**
+
+- [Source blog](https://www.bitsight.com/blog/latrodectus-are-you-coming-back)
+- [AFB graph](./attack-flow-builder/latrodectus/Latrodectus-032725.png) (image)
+- [STIX graph](./stix-visualizer/latrodectus/latrodectus-viz.png) (image)
+- [.afb file](./attack-flow-builder/latrodectus/Latrodectus-032725.afb) (loadable into AFB)
+- [STIX JSON file](./stix-visualizer/latrodectus/latrodectus-stix.json) (loadable into STIXviz)
+
+## **[STIX Visualizer](https://github.com/oasis-open/cti-stix-visualization)**
+The STIX Visualizer (STIXviz) displays STIX content supported by various schemas. Malware analysis information should be captured in STIX using the [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9); details and its schema are available in the [OASIS Common Object Repository (COR)](https://github.com/oasis-open/cti-stix-common-objects/tree/main).
+
+**Resources**
+
+- [STIXviz online](https://oasis-open.github.io/cti-stix-visualization/) 
+- [STIXviz download](https://github.com/oasis-open/cti-stix-visualization)
+- [Malware Behavior Extension Definition Object](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9)
+- [Custom STIXviz configuration file](./stix-visualizer/stix2viz.js)
+- [Custom STIXViz icons](./stix-visualizer/mbc-icons)
+- [STIX Validator](https://github.com/oasis-open/cti-stix-validator)
+- [MBC STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1)
+- [ATT&CK STIX 2.0 representation](https://github.com/mitre/cti/tree/master/enterprise-attack)
+
+
+**Usage Notes**
+- For a node to be visable in STIXviz, the object's STIX JSON must be included in the STIX Bundle. The required JSON objects can be found in the STIX 2 representations for [MBC](https://github.com/MBCProject/mbc-stix2.1) and [ATT&CK](https://github.com/mitre/cti/tree/master/enterprise-attack).
+- A custom STIXviz [configuation file](./stix-visualizer/stix2viz.js) is needed to display MBC content.
+- A custom set of [MBC icons](./stix-visualizer/mbc-icons.js) is available for displaying MBC content in STIXViz.  Otherwise, STIXviz will use a generic marker for all the object types it does not recognize.
+
+**Best Practices**
+
+- Use STIX Relationship Objects (SROs) to show chronology between behaviors. 
+    - For example, Behavior "leads-to" Behavior.
+    - Relationship types are not defined in the malware behavior extension, but the *relationship_type* property can be any string. 
+    - Explicit relationships between Behavior objects may be defined in a future version of the extension.
+- Use SROs to capture relationships between Behavior and Malware objects. 
+    - For example, a Behavior "delivers" Malware. 
+- Use SROs to capture relationships between Malware objects
+    - For example, Malware "drops" Malware.
+- Use SROs to capture chronology information.
+    - For example, Behavior "leads-to" Behavior.
+    - The *created* and *modified* common properties could be used to capture chronology, but the properties are not displayed in the STIXviz graph.
+- Use Grouping objects to specify AND and OR operations. 
+    - The *context* property is set equal to "and" or "or." 
+    - All objects referenced in a Grouping *object_refs* property are those being and-ed or or-ed. 
+    - An SRO would be defined as a Behavior "chooses-from" Grouping.
+- Use Grouping objects to capture components of modular malware or sets of C2 commands 
+    - The *context* is set equal to "chooses-from".
+- Use an SRO to capture a conditional operation.
+    - Behavior "if-true" Behavior and Behavior "if-false" Behavior. 
+- Use an Incident object (and associated Event and Impact objects) when capturing objects such as Threat Actors and Indicators.
+    - See the [Incident Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/incident-ef7) in the OASIS Common COR.
+
+
+## **[Attack Flow Builder](https://github.com/center-for-threat-informed-defense/attack-flow)** 
+The Attack Flow Builder allows a user to build a graph by inserting nodes and edges. Nodes can be Attack Flow objects (Action, Asset, AND/OR operators, and a Conditional object), STIX Domain Objects (SDOs), or STIX Cyber Observables (SCOs). The Attack Flow team defined a [STIX Extension Definition](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix) so that an AFB diagram can be saved as a STIX Bundle.
+
+**Resources**
+
+- [Online AFB tool](https://center-for-threat-informed-defense.github.io/attack-flow/ui/)
+- [AFB STIX Extension Definition Object](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix)
+- [Attack Flow STIX schema](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/stix)     
+
+**Usage Notes**
+
+- ATT&CK Tactics and Techniques are available in property drop-down menus.
+- MBC Behaviors, Methods, and Objectives must be manually entered.
+- Any Action node without an incoming edge is considered a start_ref to the Flow.
+- AFB relationships are all generic "related-to" (i.e., relationships have no properties).
+- In the STIX output, relationships are only created between Attack Flow objects (Actions, Assets).
+- The STIXviz configuration file would need to be modified to fully display Attack Flow objects.
+
+**Best Practices**
+
+- Use the description field for details that will help the viewer's understanding.
+- When capturing ATT&CK content, Action objects are better than STIX objects because they offer drop-down menus of ATT&CK Tactics and Techniques.
+- MBC content should be captured with Action objects to align with the capture of ATT&CK content. 
+- STIX Observables should be used instead of AFB Assets because they have more properties for capturing details.
+- An AFB graph may be disconnected (a collection of subgraphs) when capturing individual execution paths.

yvisualization/attack-flow-builder/icedid/IcedID-032725.json

@@ -0,0 +1,484 @@
+{
+  "type": "bundle",
+  "id": "bundle--e6c7f586-0ad8-4a0e-b2f8-b2c8ff9b4f19",
+  "spec_version": "2.1",
+  "created": "2025-03-31T13:11:04.256Z",
+  "modified": "2025-03-31T13:11:04.256Z",
+  "objects": [
+    {
+      "type": "extension-definition",
+      "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "name": "Attack Flow",
+      "description": "Extends STIX 2.1 with features to create Attack Flows.",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json",
+      "version": "2.0.0",
+      "extension_types": [
+        "new-sdo"
+      ],
+      "external_references": [
+        {
+          "source_name": "Documentation",
+          "description": "Documentation for Attack Flow",
+          "url": "https://center-for-threat-informed-defense.github.io/attack-flow"
+        },
+        {
+          "source_name": "GitHub",
+          "description": "Source code repository for Attack Flow",
+          "url": "https://github.com/center-for-threat-informed-defense/attack-flow"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "name": "MITRE Center for Threat-Informed Defense",
+      "identity_class": "organization"
+    },
+    {
+      "type": "attack-flow",
+      "id": "attack-flow--49e4b0e6-5cc7-4757-81db-b1ae6788cd41",
+      "spec_version": "2.1",
+      "created": "2025-02-21T15:58:38.809Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "created_by_ref": "identity--4458ed6f-138c-4356-924e-c6ae5bc9db18",
+      "start_refs": [
+        "attack-action--ac0751dd-123e-488a-a093-6b5170f8e694",
+        "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8"
+      ],
+      "name": "IcedID",
+      "description": "Visual displaying IcedID malware behavior",
+      "scope": "malware",
+      "external_references": [
+        {
+          "source_name": "THREAT ANALYSIS: From IcedID to Domain Compromise",
+          "url": "https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--4458ed6f-138c-4356-924e-c6ae5bc9db18",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "Maddie Bright"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--ac0751dd-123e-488a-a093-6b5170f8e694",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Malicious File",
+      "tactic_id": "TA0002",
+      "tactic_ref": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5",
+      "technique_id": "T1204.002",
+      "technique_ref": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e",
+      "description": "User executes a malicious archive",
+      "effect_refs": [
+        "attack-action--5ac84220-2268-4513-a117-dd38a5402739"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--5ac84220-2268-4513-a117-dd38a5402739",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Hidden Files and Directories",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1564.001",
+      "technique_ref": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+      "description": "Archive contains a hidden file which is a dependency called by the visible LNK file"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "description": "Used for executing DLL files",
+      "effect_refs": [
+        "attack-action--bae7ae51-0d92-4bcd-b0a1-8176fe231f3c"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Ingress Tool Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "E1105",
+      "effect_refs": [
+        "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Executable Code Obfuscation",
+      "tactic_id": "OB0002",
+      "technique_id": "B0032",
+      "description": "File is obfuscated as demonstrated in the report"
+    },
+    {
+      "type": "file",
+      "id": "file--11f4d871-cc16-4e49-b4b1-528b361d9415",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "Twelfth.bat"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--1c8faaae-3d55-49ed-ba8d-e56f72d736bd",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Command and Scripting Interpreter",
+      "tactic_id": "OB0009",
+      "technique_id": "E1059",
+      "description": "bat file uses cmd.exe for executing further commands",
+      "effect_refs": [
+        "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bae7ae51-0d92-4bcd-b0a1-8176fe231f3c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Connect to Server",
+      "tactic_id": "OC0006",
+      "technique_id": "C0002.009",
+      "description": "connects to chronofire[.]info",
+      "effect_refs": [
+        "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Copy File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0045",
+      "description": "Uses xcopy.exe",
+      "effect_refs": [
+        "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "effect_refs": [
+        "attack-action--8814dbd7-b9c9-41a8-87f8-2a00c57d1d85",
+        "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Decrypt Data",
+      "tactic_id": "OC0005",
+      "technique_id": "C0031",
+      "description": "Decryption key is file provided in initial archive"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--8814dbd7-b9c9-41a8-87f8-2a00c57d1d85",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Scheduled Task",
+      "tactic_id": "TA0003",
+      "tactic_ref": "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
+      "technique_id": "T1053.005",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Executes xaeywn1.dll at every logon and every hour",
+      "effect_refs": [
+        "attack-action--a690f62f-30c3-4c78-a460-0779d8893282"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--5e395ad7-7b62-4876-b26c-2de21d8db034",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Connect to Server",
+      "tactic_id": "OC0006",
+      "technique_id": "C0002.009",
+      "description": "Domains observed were known to be connected to icedID",
+      "effect_refs": [
+        "attack-action--88bd84e5-e3b0-4dff-863e-5fedb8f4dc28"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--88bd84e5-e3b0-4dff-863e-5fedb8f4dc28",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Execute Shell Command",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.016",
+      "description": "Interactive remote shell session starts.  Attacker uses this to manually control malware."
+    },
+    {
+      "type": "file",
+      "id": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "superstring.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--659602d1-d017-490b-8e31-68b567baa7ec",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "%TEMP%\\homesteading.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "xaeywn1.dll"
+    },
+    {
+      "type": "file",
+      "id": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "name": "init_dll_64.dll"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--a690f62f-30c3-4c78-a460-0779d8893282",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Rundll32",
+      "tactic_id": "TA0005",
+      "tactic_ref": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
+      "technique_id": "T1218.011",
+      "technique_ref": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
+      "effect_refs": [
+        "attack-action--5e395ad7-7b62-4876-b26c-2de21d8db034"
+      ]
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--38d38edb-536e-45a8-8c93-59975d422ac3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--5ac84220-2268-4513-a117-dd38a5402739",
+      "target_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--58038769-6a95-44bb-ba87-c7cd82309002",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--4c9d6521-a65b-4982-8c61-f03fd1494615",
+      "target_ref": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--e40259b3-205b-4263-a0fb-7937c8734bec",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--eb5ca1e6-a396-4040-8318-436c3cce18e8",
+      "target_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--ee51df71-182c-4d5d-8a4d-6aeec4ebe661",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--11f4d871-cc16-4e49-b4b1-528b361d9415",
+      "target_ref": "attack-action--1c8faaae-3d55-49ed-ba8d-e56f72d736bd"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--77e05fad-4cc6-4973-8b04-d874022723f1",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--bce4df0c-1803-4c08-b8b6-394e266ff38d",
+      "target_ref": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--f6621606-39b7-4b29-a867-1d79d57d8c64",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--eb109108-56ac-46e5-9d85-692afaa28a68",
+      "target_ref": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--2d2883dc-d4ae-4fa0-9f1a-b027bbebc91c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--01b76ff0-5e05-491d-b188-94e3ecea47f8",
+      "target_ref": "file--659602d1-d017-490b-8e31-68b567baa7ec"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--9548d521-fb15-455b-8119-d519b08027b4",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--659602d1-d017-490b-8e31-68b567baa7ec",
+      "target_ref": "attack-action--268f83ee-d3de-4320-bdde-ec6a04c46280"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--39bfb8bc-a964-45cf-a615-a7eea3b2bfcc",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--e91caa3d-6050-4df6-9428-dafc5415c8e4",
+      "target_ref": "attack-action--c15548fd-3f78-41c1-88ce-b9b7ef361170"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--43118de5-c0bc-404f-87fe-f123ce2d10db",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:11:04.256Z",
+      "modified": "2025-03-31T13:11:04.256Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--9ec1e943-a76c-49ec-8a3d-b706eed5238e",
+      "target_ref": "attack-action--a690f62f-30c3-4c78-a460-0779d8893282"
+    }
+  ]
+}

yvisualization/attack-flow-builder/latrodectus/Latrodectus-032725.json

@@ -0,0 +1,749 @@
+{
+  "type": "bundle",
+  "id": "bundle--01ade9ab-1f53-4a2e-ad67-ec97110f0a16",
+  "spec_version": "2.1",
+  "created": "2025-03-31T13:09:11.852Z",
+  "modified": "2025-03-31T13:09:11.852Z",
+  "objects": [
+    {
+      "type": "extension-definition",
+      "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "name": "Attack Flow",
+      "description": "Extends STIX 2.1 with features to create Attack Flows.",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json",
+      "version": "2.0.0",
+      "extension_types": [
+        "new-sdo"
+      ],
+      "external_references": [
+        {
+          "source_name": "Documentation",
+          "description": "Documentation for Attack Flow",
+          "url": "https://center-for-threat-informed-defense.github.io/attack-flow"
+        },
+        {
+          "source_name": "GitHub",
+          "description": "Source code repository for Attack Flow",
+          "url": "https://github.com/center-for-threat-informed-defense/attack-flow"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "name": "MITRE Center for Threat-Informed Defense",
+      "identity_class": "organization"
+    },
+    {
+      "type": "attack-flow",
+      "id": "attack-flow--63e420c7-562f-4a0a-ac7d-7e59f6b904c3",
+      "spec_version": "2.1",
+      "created": "2025-02-04T14:50:20.511Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "created_by_ref": "identity--98a5dd1b-9f86-4599-aa25-9ef0b78f3791",
+      "start_refs": [
+        "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+        "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+        "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925",
+        "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+        "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+        "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c"
+      ],
+      "name": "Latrodectus",
+      "scope": "malware",
+      "external_references": [
+        {
+          "source_name": "Latrodectus, are you coming back? | Bitsight",
+          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--98a5dd1b-9f86-4599-aa25-9ef0b78f3791",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "name": "Maddie Bright",
+      "identity_class": "individual",
+      "contact_information": "mbright@mitre.org"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Process Environment Block BeingDebugged",
+      "tactic_id": "OB0001",
+      "technique_id": "B0001.035"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.853Z",
+      "modified": "2025-03-31T13:09:11.853Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Check Processes",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.004",
+      "description": "Assesses for > 75 running processes for Windows 10 and newer, > 50 for OS older than Windows 10"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Modern Specs Check",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.013",
+      "description": "Checks for 64-bit host"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Unique Hardware/Firmware Check - MAC Address",
+      "tactic_id": "OB0001",
+      "technique_id": "B0009.028",
+      "description": "Ensures MAC addresses exist and are valid values"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Check Mutex",
+      "tactic_id": "OC0003",
+      "technique_id": "C0043",
+      "description": "Looks for mutex named 'running'",
+      "effect_refs": [
+        "attack-condition--4091668b-3f98-4b05-95a9-521ec3d6703a"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--e594ebea-5a98-4200-81ac-6a688e657831",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "System Information Discovery",
+      "tactic_id": "OB0007",
+      "technique_id": "E1082",
+      "description": "GetVolumeInformationW is used to determine the serial number for computing the bot ID",
+      "effect_refs": [
+        "attack-action--961e50bf-5799-43f2-9277-df5d72d27de3"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--218c1310-e244-493c-a8d5-76a71befb735",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "XOR",
+      "tactic_id": "OC0004",
+      "technique_id": "C0053.002",
+      "description": "Decodes XOR-encrypted file contents"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--25137e20-5ce8-42f5-ba2e-ff1cbc5c32c5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Read File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0051",
+      "description": "Fetches the C2 URLs",
+      "effect_refs": [
+        "attack-action--218c1310-e244-493c-a8d5-76a71befb735"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Authentication",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.011",
+      "description": "sends MAC addresses, hostname, and host domain"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f7a96d30-4e16-4955-94bc-64aa95732254",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "RC4",
+      "tactic_id": "OC0005",
+      "technique_id": "C0027.009",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Encypt the C2 beacon",
+      "effect_refs": [
+        "attack-action--02f64672-ba05-4090-b1ef-066a28e7f0a5"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--02f64672-ba05-4090-b1ef-066a28e7f0a5",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Base64",
+      "tactic_id": "OC0005",
+      "technique_id": "C0026.001",
+      "description": "Encode the C2 beacon",
+      "effect_refs": [
+        "attack-action--29c279a7-55af-4e93-9bc6-68923570ac0f"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--c7b64762-30d9-42af-90f3-994fd35ae504",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Directory Listing",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.012",
+      "description": "Collects file names from desktop"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f0d4d59a-1f6a-4d51-8c6a-268be304f864",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Send System Information",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.006",
+      "description": "Runs pre-set group of WIndows recon commands"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--8fafaa85-739d-4c15-9038-f9f0cf20c92e",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Process Discovery",
+      "tactic_id": "TA0007",
+      "tactic_ref": "x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9",
+      "technique_id": "T1057",
+      "technique_ref": "attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+      "description": "collects PIDs and names of running processes"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--17382d39-8d97-457d-9a89-0f8d77dae0de",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Server to Client File Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.003",
+      "description": "Downloads DLL or EXE files"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--9bbbe9ff-b82f-40d9-840d-c6ad2439b7e6",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Execute File",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.013",
+      "description": "Uses rundll32 or cmd.exe to execute transferred files"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f5c36be6-4afc-45bb-b98e-76f4f6a1e09b",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Ingress Tool Transfer",
+      "tactic_id": "OB0004",
+      "technique_id": "E1105",
+      "description": "Downloads a stealer module"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--1d85143a-059a-438c-a794-10012880f3e8",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "Sandbox/VM Checks",
+      "context": "Malware checks to ensure it is not executing within an analysis environment",
+      "object_refs": [
+        "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c",
+        "attack-action--582fdf4c-da5a-45f9-ae83-b9dad0d8ccc5",
+        "attack-action--257ffdd4-bb50-425b-9091-f82fc184eccc",
+        "attack-action--7083e4bb-73a9-4982-b891-e65a17fd4cb3",
+        "attack-action--0eea63f2-14c5-404e-840d-1bcf082fe164",
+        "attack-action--c7f20500-3dab-4ffc-b3cb-545a1b901925"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--ed9ce25e-3124-46c3-9800-bf118b65c99c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Discovers Indication of Execution in Sandbox?",
+      "on_false_refs": [
+        "attack-action--e594ebea-5a98-4200-81ac-6a688e657831"
+      ],
+      "on_true_refs": [
+        "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--961e50bf-5799-43f2-9277-df5d72d27de3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Non-cryptographic Hash: FNV Hash",
+      "tactic_id": "OC0004",
+      "technique_id": "C0030.005",
+      "description": "Used to calculate group ID",
+      "effect_refs": [
+        "attack-action--2e8bc208-cd80-44ed-ad8f-cf71d00749d3"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--0f72ef7c-2379-44d9-9927-424fcfb6968c",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "C2 File Exists?",
+      "on_true_refs": [
+        "attack-action--25137e20-5ce8-42f5-ba2e-ff1cbc5c32c5"
+      ],
+      "on_false_refs": [
+        "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--2e8bc208-cd80-44ed-ad8f-cf71d00749d3",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Self-Discovery",
+      "tactic_id": "OB0007",
+      "technique_id": "B0038",
+      "description": "Check exe running from %appdata%",
+      "effect_refs": [
+        "attack-condition--c8cbe298-71ee-4ae3-92eb-dbd4e2e66a4f"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--c8cbe298-71ee-4ae3-92eb-dbd4e2e66a4f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Executing from AppData?",
+      "on_false_refs": [
+        "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47"
+      ],
+      "on_true_refs": [
+        "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Copy FIle",
+      "tactic_id": "OC0001",
+      "technique_id": "C0045",
+      "description": "Copies executable to %appdata%",
+      "effect_refs": [
+        "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Delete FIle",
+      "tactic_id": "OC0001",
+      "technique_id": "C0047",
+      "description": "Deletes old executable after executing in appdata"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Scheduled Task",
+      "tactic_id": "TA0003",
+      "tactic_ref": "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
+      "technique_id": "T1053.005",
+      "technique_ref": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+      "description": "Creates task which runs at every logon",
+      "effect_refs": [
+        "attack-condition--0f72ef7c-2379-44d9-9927-424fcfb6968c"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--bc4c9f48-8244-494a-9241-7b062bd4620d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Receive Data",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.002",
+      "description": "Receives commands from C2"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--56d45603-8674-4651-8e68-b9aa9ffa8737",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "C2 Commands",
+      "context": "Commands malware receives from C2 and sends data in response",
+      "object_refs": [
+        "attack-action--c7b64762-30d9-42af-90f3-994fd35ae504",
+        "attack-action--f0d4d59a-1f6a-4d51-8c6a-268be304f864",
+        "attack-action--9bbbe9ff-b82f-40d9-840d-c6ad2439b7e6",
+        "attack-action--f5c36be6-4afc-45bb-b98e-76f4f6a1e09b",
+        "attack-action--17382d39-8d97-457d-9a89-0f8d77dae0de",
+        "attack-action--aa621f2f-6695-4280-a648-12b7399d740b",
+        "attack-action--8fafaa85-739d-4c15-9038-f9f0cf20c92e"
+      ]
+    },
+    {
+      "type": "attack-condition",
+      "id": "attack-condition--4091668b-3f98-4b05-95a9-521ec3d6703a",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "description": "Does the mutex already exist?",
+      "on_true_refs": [
+        "attack-action--ea43ca4b-a714-46fa-a2a7-6c0dce01d9e6"
+      ],
+      "on_false_refs": [
+        "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--ea43ca4b-a714-46fa-a2a7-6c0dce01d9e6",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Create Mutex",
+      "tactic_id": "OC0003",
+      "technique_id": "C0041",
+      "description": "Mutex ensures only one instance of malware is running"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--aa621f2f-6695-4280-a648-12b7399d740b",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Write File",
+      "tactic_id": "OC0001",
+      "technique_id": "C0052",
+      "description": "Updates C2 URL file"
+    },
+    {
+      "type": "grouping",
+      "id": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "C2 Communications Loop",
+      "context": "After a C2 connection is established, the bot waits to receive commands and sends data back to the C2.",
+      "object_refs": [
+        "attack-action--f7a96d30-4e16-4955-94bc-64aa95732254",
+        "grouping--56d45603-8674-4651-8e68-b9aa9ffa8737",
+        "attack-action--bc4c9f48-8244-494a-9241-7b062bd4620d"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--29c279a7-55af-4e93-9bc6-68923570ac0f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Send Data",
+      "tactic_id": "OB0004",
+      "technique_id": "B0030.001",
+      "description": "Data collected by implant as per C2 commands is sent to C2 via HTTPS"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f2cc7510-ee8e-46b2-b110-56e51506d094",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Suicide Exit",
+      "tactic_id": "OB0009",
+      "technique_id": "B0025.001"
+    },
+    {
+      "type": "file",
+      "id": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "name": "Executable"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.854Z",
+      "modified": "2025-03-31T13:09:11.854Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Command and Scripting Interpreter",
+      "technique_id": "T1059",
+      "technique_ref": "attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830",
+      "effect_refs": [
+        "attack-action--d0667ee0-ef70-49e0-a96a-b6777bda94ce",
+        "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d"
+      ]
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--6780f44b-8e45-4f5e-a711-4075fe133e2d",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--218c1310-e244-493c-a8d5-76a71befb735",
+      "target_ref": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--c4f5f848-38e3-49df-84c4-19ee77a12f14",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--6daf1e2b-0451-4233-9274-4e29c95e4204",
+      "target_ref": "grouping--2b4339ab-0b45-4cea-935f-9eda3205ab0a"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--5558d034-8b62-420b-9b76-9de3fe217b4f",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "attack-action--3444fb5b-da4d-462f-88ce-3f7453e37f47",
+      "target_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--22778212-ea2d-41bb-b207-248a2fd9e048",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "target_ref": "attack-action--73fd998a-ea52-4cdb-a957-e08cbefef97d"
+    },
+    {
+      "type": "relationship",
+      "id": "relationship--34d11c40-be04-48ca-9799-c1f134037a24",
+      "spec_version": "2.1",
+      "created": "2025-03-31T13:09:11.855Z",
+      "modified": "2025-03-31T13:09:11.855Z",
+      "relationship_type": "related-to",
+      "source_ref": "file--4d78d74a-eaf4-477d-ad24-fdbba67fa4cd",
+      "target_ref": "attack-action--f2cfaa6c-5204-4708-8864-8f1d277c3170"
+    }
+  ]
+}