{
    "type": "bundle",
    "id": "bundle--3a775411-72df-4e8b-9fa5-6b5082fde998",
    "objects": [
        {
            "type": "x-mitre-collection",
            "id": "x-mitre-collection--90c00720-636b-4485-b342-8751d232bf09",
            "x_mitre_attack_spec_version": "3.3.0",
            "name": "ICS ATT&CK",
            "x_mitre_version": "20.0",
            "description": "The ATT&CK for Industrial Control Systems (ICS) knowledge base categorizes the unique set of tactics, techniques, and procedures (TTPs) used by threat actors in the ICS technology domain. ATT&CK for ICS outlines the portions of an ICS attack that are out of scope of Enterprise and reflects the various phases of an adversary’s attack life cycle and the assets and systems they are known to target.",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "created": "2026-08-04T20:31:11.216Z",
            "modified": "2026-10-13T17:54:18.154Z",
            "x_mitre_contents": [
                {
                    "object_ref": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
                    "object_modified": "2026-04-20T20:58:37.791Z"
                },
                {
                    "object_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
                    "object_modified": "2026-10-13T17:48:44.278Z"
                },
                {
                    "object_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
                    "object_modified": "2026-10-13T17:48:47.174Z"
                },
                {
                    "object_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
                    "object_modified": "2026-10-13T17:48:38.152Z"
                },
                {
                    "object_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
                    "object_modified": "2026-10-07T21:17:19.764Z"
                },
                {
                    "object_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
                    "object_modified": "2026-10-13T17:48:38.761Z"
                },
                {
                    "object_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
                    "object_modified": "2026-05-12T15:12:00.621Z"
                },
                {
                    "object_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
                    "object_modified": "2026-10-13T17:48:49.021Z"
                },
                {
                    "object_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
                    "object_modified": "2026-10-13T17:48:54.157Z"
                },
                {
                    "object_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
                    "object_modified": "2026-10-09T18:14:56.779Z"
                },
                {
                    "object_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
                    "object_modified": "2025-04-16T21:26:10.752Z"
                },
                {
                    "object_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
                    "object_modified": "2026-10-13T17:48:33.649Z"
                },
                {
                    "object_ref": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60",
                    "object_modified": "2026-04-20T20:58:51.323Z"
                },
                {
                    "object_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
                    "object_modified": "2026-10-13T17:48:51.235Z"
                },
                {
                    "object_ref": "attack-pattern--23270e54-1d68-4c3b-b763-b25607bcef80",
                    "object_modified": "2025-10-24T17:48:31.492Z"
                },
                {
                    "object_ref": "attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c",
                    "object_modified": "2026-10-07T16:50:33.026Z"
                },
                {
                    "object_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
                    "object_modified": "2026-10-13T17:48:49.639Z"
                },
                {
                    "object_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
                    "object_modified": "2026-10-13T17:48:53.838Z"
                },
                {
                    "object_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
                    "object_modified": "2026-10-07T20:34:55.625Z"
                },
                {
                    "object_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
                    "object_modified": "2026-10-13T17:48:50.591Z"
                },
                {
                    "object_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
                    "object_modified": "2026-10-13T17:48:34.560Z"
                },
                {
                    "object_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
                    "object_modified": "2026-10-13T17:48:42.391Z"
                },
                {
                    "object_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
                    "object_modified": "2026-10-13T17:48:35.149Z"
                },
                {
                    "object_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
                    "object_modified": "2026-10-13T17:48:45.236Z"
                },
                {
                    "object_ref": "attack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163",
                    "object_modified": "2025-04-16T21:26:12.172Z"
                },
                {
                    "object_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
                    "object_modified": "2026-10-07T21:24:33.641Z"
                },
                {
                    "object_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
                    "object_modified": "2026-10-13T17:48:34.856Z"
                },
                {
                    "object_ref": "attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958",
                    "object_modified": "2026-10-07T16:51:17.493Z"
                },
                {
                    "object_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
                    "object_modified": "2026-10-13T17:48:49.322Z"
                },
                {
                    "object_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
                    "object_modified": "2026-10-13T17:48:43.645Z"
                },
                {
                    "object_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
                    "object_modified": "2026-10-13T17:48:37.841Z"
                },
                {
                    "object_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
                    "object_modified": "2026-10-13T17:48:55.761Z"
                },
                {
                    "object_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
                    "object_modified": "2026-10-13T17:48:42.082Z"
                },
                {
                    "object_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
                    "object_modified": "2026-10-13T17:48:39.050Z"
                },
                {
                    "object_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
                    "object_modified": "2026-10-13T17:48:56.775Z"
                },
                {
                    "object_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
                    "object_modified": "2026-10-13T17:48:46.553Z"
                },
                {
                    "object_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
                    "object_modified": "2026-10-13T17:48:53.525Z"
                },
                {
                    "object_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
                    "object_modified": "2026-10-13T17:48:47.792Z"
                },
                {
                    "object_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
                    "object_modified": "2026-10-13T17:48:36.361Z"
                },
                {
                    "object_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
                    "object_modified": "2026-10-13T17:48:56.454Z"
                },
                {
                    "object_ref": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b",
                    "object_modified": "2026-04-20T20:58:39.117Z"
                },
                {
                    "object_ref": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455",
                    "object_modified": "2026-04-20T20:58:41.104Z"
                },
                {
                    "object_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
                    "object_modified": "2026-10-13T17:48:51.581Z"
                },
                {
                    "object_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
                    "object_modified": "2026-10-13T17:48:43.027Z"
                },
                {
                    "object_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
                    "object_modified": "2026-10-07T21:51:02.824Z"
                },
                {
                    "object_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
                    "object_modified": "2025-04-15T19:58:29.210Z"
                },
                {
                    "object_ref": "attack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064",
                    "object_modified": "2025-10-24T17:48:46.334Z"
                },
                {
                    "object_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
                    "object_modified": "2026-10-13T17:48:39.649Z"
                },
                {
                    "object_ref": "attack-pattern--539d0484-fe95-485a-b654-86991c0d0d00",
                    "object_modified": "2025-10-24T17:48:47.931Z"
                },
                {
                    "object_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
                    "object_modified": "2026-10-13T17:48:40.569Z"
                },
                {
                    "object_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
                    "object_modified": "2026-10-13T17:48:46.862Z"
                },
                {
                    "object_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
                    "object_modified": "2026-10-13T17:48:52.564Z"
                },
                {
                    "object_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
                    "object_modified": "2026-10-13T17:48:42.708Z"
                },
                {
                    "object_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
                    "object_modified": "2025-04-15T19:58:33.142Z"
                },
                {
                    "object_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
                    "object_modified": "2026-10-13T17:48:59.405Z"
                },
                {
                    "object_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
                    "object_modified": "2026-10-13T17:48:38.469Z"
                },
                {
                    "object_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
                    "object_modified": "2026-10-13T17:48:57.097Z"
                },
                {
                    "object_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
                    "object_modified": "2026-10-13T17:48:35.442Z"
                },
                {
                    "object_ref": "attack-pattern--5f3da2f3-91c8-4d8b-a02f-bf43a11def55",
                    "object_modified": "2025-10-24T17:48:50.649Z"
                },
                {
                    "object_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
                    "object_modified": "2025-04-16T21:26:14.990Z"
                },
                {
                    "object_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
                    "object_modified": "2026-10-13T17:48:58.412Z"
                },
                {
                    "object_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
                    "object_modified": "2025-04-16T21:26:15.157Z"
                },
                {
                    "object_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
                    "object_modified": "2026-10-13T17:48:48.102Z"
                },
                {
                    "object_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
                    "object_modified": "2026-10-13T17:48:57.756Z"
                },
                {
                    "object_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
                    "object_modified": "2026-10-13T17:48:35.752Z"
                },
                {
                    "object_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
                    "object_modified": "2026-10-13T17:48:52.885Z"
                },
                {
                    "object_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
                    "object_modified": "2026-10-13T17:48:58.743Z"
                },
                {
                    "object_ref": "attack-pattern--7374ab87-0782-41f8-b415-678c0950bb2a",
                    "object_modified": "2025-10-24T17:48:57.419Z"
                },
                {
                    "object_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
                    "object_modified": "2026-10-13T17:48:50.273Z"
                },
                {
                    "object_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
                    "object_modified": "2026-10-13T17:48:59.072Z"
                },
                {
                    "object_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
                    "object_modified": "2026-10-13T17:48:39.943Z"
                },
                {
                    "object_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
                    "object_modified": "2026-10-13T17:48:48.399Z"
                },
                {
                    "object_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
                    "object_modified": "2026-10-13T17:48:49.952Z"
                },
                {
                    "object_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
                    "object_modified": "2026-10-13T17:48:56.116Z"
                },
                {
                    "object_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
                    "object_modified": "2025-04-16T21:26:15.731Z"
                },
                {
                    "object_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
                    "object_modified": "2026-10-09T17:29:41.220Z"
                },
                {
                    "object_ref": "attack-pattern--8535b71e-3c12-4258-a4ab-40257a1becc4",
                    "object_modified": "2026-04-20T20:58:43.011Z"
                },
                {
                    "object_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
                    "object_modified": "2026-10-13T17:48:44.918Z"
                },
                {
                    "object_ref": "attack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349",
                    "object_modified": "2026-04-20T20:58:48.356Z"
                },
                {
                    "object_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
                    "object_modified": "2026-10-13T17:48:54.492Z"
                },
                {
                    "object_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
                    "object_modified": "2026-10-13T17:48:36.943Z"
                },
                {
                    "object_ref": "attack-pattern--94f042ae-3033-4a8d-9ec3-26396533a541",
                    "object_modified": "2025-10-24T17:49:07.297Z"
                },
                {
                    "object_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
                    "object_modified": "2026-10-13T17:48:43.971Z"
                },
                {
                    "object_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
                    "object_modified": "2026-10-13T17:48:51.921Z"
                },
                {
                    "object_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
                    "object_modified": "2026-05-12T15:12:00.706Z"
                },
                {
                    "object_ref": "attack-pattern--a8cfd474-9358-464f-a169-9c6f099a8e8a",
                    "object_modified": "2025-10-24T17:49:11.949Z"
                },
                {
                    "object_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
                    "object_modified": "2026-10-13T17:48:33.137Z"
                },
                {
                    "object_ref": "attack-pattern--abb0a255-eb9c-48d0-8f5c-874bb84c0e45",
                    "object_modified": "2025-10-24T17:49:12.937Z"
                },
                {
                    "object_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
                    "object_modified": "2026-10-09T16:56:53.660Z"
                },
                {
                    "object_ref": "attack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7",
                    "object_modified": "2025-10-24T17:49:13.466Z"
                },
                {
                    "object_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
                    "object_modified": "2026-10-13T17:48:46.244Z"
                },
                {
                    "object_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
                    "object_modified": "2026-10-13T17:48:50.906Z"
                },
                {
                    "object_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
                    "object_modified": "2026-10-13T17:48:41.765Z"
                },
                {
                    "object_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
                    "object_modified": "2025-04-15T19:59:00.088Z"
                },
                {
                    "object_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
                    "object_modified": "2026-05-12T15:12:00.709Z"
                },
                {
                    "object_ref": "attack-pattern--b9160e77-ea9e-4ba9-b1c8-53a3c466b13d",
                    "object_modified": "2026-04-20T20:58:44.575Z"
                },
                {
                    "object_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
                    "object_modified": "2026-10-13T17:48:34.261Z"
                },
                {
                    "object_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
                    "object_modified": "2026-10-13T17:48:41.446Z"
                },
                {
                    "object_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
                    "object_modified": "2026-10-13T17:48:36.055Z"
                },
                {
                    "object_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
                    "object_modified": "2026-10-13T17:48:57.430Z"
                },
                {
                    "object_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
                    "object_modified": "2026-10-13T17:48:40.879Z"
                },
                {
                    "object_ref": "attack-pattern--c9a8d958-fcdb-40d2-af4c-461c8031651a",
                    "object_modified": "2026-04-20T20:58:49.917Z"
                },
                {
                    "object_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
                    "object_modified": "2026-10-13T17:48:33.956Z"
                },
                {
                    "object_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
                    "object_modified": "2026-10-13T17:48:37.232Z"
                },
                {
                    "object_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
                    "object_modified": "2026-10-09T17:48:25.598Z"
                },
                {
                    "object_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
                    "object_modified": "2026-10-13T17:48:37.554Z"
                },
                {
                    "object_ref": "attack-pattern--d614a9cf-18eb-4800-81e4-ab8ddf0baa73",
                    "object_modified": "2025-10-24T17:49:27.888Z"
                },
                {
                    "object_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
                    "object_modified": "2026-10-13T17:48:43.335Z"
                },
                {
                    "object_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
                    "object_modified": "2026-10-13T17:48:59.738Z"
                },
                {
                    "object_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
                    "object_modified": "2026-10-13T17:48:53.199Z"
                },
                {
                    "object_ref": "attack-pattern--e0d74479-86d2-465d-bf36-903ebecef43e",
                    "object_modified": "2025-10-24T17:49:30.517Z"
                },
                {
                    "object_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
                    "object_modified": "2026-10-13T17:48:55.183Z"
                },
                {
                    "object_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
                    "object_modified": "2026-10-13T17:48:54.826Z"
                },
                {
                    "object_ref": "attack-pattern--e2994b6a-122b-4043-b654-7411c5198ec0",
                    "object_modified": "2025-10-24T17:49:30.966Z"
                },
                {
                    "object_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
                    "object_modified": "2025-04-15T19:59:15.775Z"
                },
                {
                    "object_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
                    "object_modified": "2026-10-09T17:14:23.887Z"
                },
                {
                    "object_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
                    "object_modified": "2026-10-13T17:48:47.496Z"
                },
                {
                    "object_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
                    "object_modified": "2026-10-13T17:48:36.649Z"
                },
                {
                    "object_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
                    "object_modified": "2026-10-13T17:48:44.597Z"
                },
                {
                    "object_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
                    "object_modified": "2026-10-13T17:48:45.539Z"
                },
                {
                    "object_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
                    "object_modified": "2026-10-13T17:48:39.341Z"
                },
                {
                    "object_ref": "attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707",
                    "object_modified": "2026-04-20T20:58:46.789Z"
                },
                {
                    "object_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
                    "object_modified": "2026-10-13T17:48:52.237Z"
                },
                {
                    "object_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
                    "object_modified": "2026-10-13T17:48:40.258Z"
                },
                {
                    "object_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
                    "object_modified": "2026-10-13T17:48:45.931Z"
                },
                {
                    "object_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
                    "object_modified": "2026-10-13T17:48:58.081Z"
                },
                {
                    "object_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
                    "object_modified": "2026-10-13T17:48:48.701Z"
                },
                {
                    "object_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
                    "object_modified": "2026-07-31T20:48:13.258Z"
                },
                {
                    "object_ref": "campaign--199f5568-ca25-4892-b7a5-870503e4d0f4",
                    "object_modified": "2026-10-09T00:56:40.965Z"
                },
                {
                    "object_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
                    "object_modified": "2026-07-31T20:48:13.868Z"
                },
                {
                    "object_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
                    "object_modified": "2026-08-04T20:48:44.047Z"
                },
                {
                    "object_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
                    "object_modified": "2026-10-13T14:29:13.954Z"
                },
                {
                    "object_ref": "campaign--65281d3e-b03c-46b8-8cd8-716363ac3cb2",
                    "object_modified": "2026-07-31T20:48:15.905Z"
                },
                {
                    "object_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
                    "object_modified": "2026-07-31T20:48:15.915Z"
                },
                {
                    "object_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
                    "object_modified": "2026-07-31T20:48:17.564Z"
                },
                {
                    "object_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
                    "object_modified": "2026-07-31T20:48:19.151Z"
                },
                {
                    "object_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
                    "object_modified": "2026-07-31T21:05:24.494Z"
                },
                {
                    "object_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
                    "object_modified": "2026-07-31T21:11:04.731Z"
                },
                {
                    "object_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
                    "object_modified": "2025-04-16T21:26:25.920Z"
                },
                {
                    "object_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
                    "object_modified": "2026-10-07T17:52:26.035Z"
                },
                {
                    "object_ref": "course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517",
                    "object_modified": "2025-04-16T21:26:26.390Z"
                },
                {
                    "object_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--2ab9fc6d-3cf6-4d7b-85f1-3ad6949233b3",
                    "object_modified": "2025-04-16T21:26:26.729Z"
                },
                {
                    "object_ref": "course-of-action--2f0160b7-e982-49d7-9612-f19b810f1722",
                    "object_modified": "2025-04-25T14:39:12.577Z"
                },
                {
                    "object_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--3222a807-521b-4a1a-aa13-f1cda45734b3",
                    "object_modified": "2025-04-16T21:26:27.274Z"
                },
                {
                    "object_ref": "course-of-action--337c4e2a-21a7-4d9a-bfee-9efd6cebf0e5",
                    "object_modified": "2025-04-25T14:39:13.297Z"
                },
                {
                    "object_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
                    "object_modified": "2026-10-07T17:50:11.297Z"
                },
                {
                    "object_ref": "course-of-action--49b306c1-a046-42c5-a4d2-30f264ada110",
                    "object_modified": "2025-04-16T21:26:27.991Z"
                },
                {
                    "object_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
                    "object_modified": "2026-10-07T17:52:00.813Z"
                },
                {
                    "object_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
                    "object_modified": "2025-04-16T21:26:28.652Z"
                },
                {
                    "object_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
                    "object_modified": "2026-05-12T15:12:00.730Z"
                },
                {
                    "object_ref": "course-of-action--6a02e38a-9629-40c0-8c7d-e98e3470315c",
                    "object_modified": "2025-04-25T14:39:15.463Z"
                },
                {
                    "object_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--86b455f2-fb63-4043-93a8-32a3a7703a02",
                    "object_modified": "2025-04-16T21:26:29.323Z"
                },
                {
                    "object_ref": "course-of-action--8a3aadd0-b5f4-433a-800e-4893e4196bb7",
                    "object_modified": "2025-04-16T21:26:29.489Z"
                },
                {
                    "object_ref": "course-of-action--8ac1d6e1-b07f-476a-9732-84984ebc2405",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--8bc4a54e-810c-4600-8b6c-08fa8413a401",
                    "object_modified": "2025-04-25T14:39:16.894Z"
                },
                {
                    "object_ref": "course-of-action--945271ef-52cd-4a2c-a4cd-09edda7ffbab",
                    "object_modified": "2026-10-09T16:01:24.197Z"
                },
                {
                    "object_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
                    "object_modified": "2025-04-16T21:26:30.090Z"
                },
                {
                    "object_ref": "course-of-action--98aa0d61-fc9d-4b2d-8f18-b25d03549f53",
                    "object_modified": "2025-04-25T14:39:17.436Z"
                },
                {
                    "object_ref": "course-of-action--99c746d7-a08a-4169-94f9-b8c0dad716fa",
                    "object_modified": "2025-04-25T14:39:17.799Z"
                },
                {
                    "object_ref": "course-of-action--9a945a29-5233-4422-a9e3-3e957b0e8bce",
                    "object_modified": "2025-04-16T21:26:30.648Z"
                },
                {
                    "object_ref": "course-of-action--9e3adcad-0b8f-4ecc-a2f3-06f607f53bf0",
                    "object_modified": "2025-04-16T21:26:30.822Z"
                },
                {
                    "object_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--ac8f3492-7fbb-4a0a-b0b4-b75ec676136c",
                    "object_modified": "2025-04-16T21:26:31.301Z"
                },
                {
                    "object_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
                    "object_modified": "2025-04-16T21:26:31.496Z"
                },
                {
                    "object_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
                    "object_modified": "2026-10-07T17:50:45.716Z"
                },
                {
                    "object_ref": "course-of-action--d48b79b2-076d-483e-949c-0d38aa347499",
                    "object_modified": "2025-04-25T14:39:19.937Z"
                },
                {
                    "object_ref": "course-of-action--da44255d-85c5-492c-baf3-ee823d44f848",
                    "object_modified": "2025-04-25T14:39:20.300Z"
                },
                {
                    "object_ref": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
                    "object_modified": "2025-04-16T21:26:32.717Z"
                },
                {
                    "object_ref": "course-of-action--ddf3e568-f065-49e2-9106-42029a28ddbd",
                    "object_modified": "2025-04-16T21:26:32.907Z"
                },
                {
                    "object_ref": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
                    "object_modified": "2025-04-16T21:26:33.110Z"
                },
                {
                    "object_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
                    "object_modified": "2025-04-16T21:26:33.298Z"
                },
                {
                    "object_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
                    "object_modified": "2025-04-16T21:26:33.475Z"
                },
                {
                    "object_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
                    "object_modified": "2026-05-12T15:12:00.731Z"
                },
                {
                    "object_ref": "course-of-action--facb8840-ebe7-49f1-b464-8ef6c8131e21",
                    "object_modified": "2025-04-16T21:26:33.833Z"
                },
                {
                    "object_ref": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
                    "object_modified": "2025-04-16T21:26:34.009Z"
                },
                {
                    "object_ref": "course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e",
                    "object_modified": "2025-04-16T21:26:34.172Z"
                },
                {
                    "object_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
                    "object_modified": "2026-05-12T16:33:30.227Z"
                },
                {
                    "object_ref": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
                    "object_modified": "2026-10-09T03:56:03.463Z"
                },
                {
                    "object_ref": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
                    "object_modified": "2026-07-31T20:48:27.733Z"
                },
                {
                    "object_ref": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
                    "object_modified": "2026-07-31T20:48:28.048Z"
                },
                {
                    "object_ref": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
                    "object_modified": "2026-07-31T20:48:30.435Z"
                },
                {
                    "object_ref": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
                    "object_modified": "2026-07-31T20:48:31.412Z"
                },
                {
                    "object_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
                    "object_modified": "2026-07-31T20:48:32.342Z"
                },
                {
                    "object_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
                    "object_modified": "2026-07-31T20:48:34.886Z"
                },
                {
                    "object_ref": "intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6",
                    "object_modified": "2026-07-31T20:48:36.792Z"
                },
                {
                    "object_ref": "intrusion-set--76d59913-1d24-4992-a8ac-05a3eb093f71",
                    "object_modified": "2025-04-18T17:59:27.618Z"
                },
                {
                    "object_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
                    "object_modified": "2026-07-31T20:48:41.930Z"
                },
                {
                    "object_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
                    "object_modified": "2026-10-07T13:46:33.122Z"
                },
                {
                    "object_ref": "intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133",
                    "object_modified": "2026-07-31T20:48:45.767Z"
                },
                {
                    "object_ref": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
                    "object_modified": "2026-07-31T20:48:46.106Z"
                },
                {
                    "object_ref": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
                    "object_modified": "2026-07-31T20:48:49.730Z"
                },
                {
                    "object_ref": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
                    "object_modified": "2026-07-31T20:48:51.374Z"
                },
                {
                    "object_ref": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
                    "object_modified": "2026-07-31T20:48:52.730Z"
                },
                {
                    "object_ref": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
                    "object_modified": "2025-04-16T20:37:51.908Z"
                },
                {
                    "object_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
                    "object_modified": "2025-04-16T20:37:53.808Z"
                },
                {
                    "object_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
                    "object_modified": "2026-04-24T02:36:25.135Z"
                },
                {
                    "object_ref": "malware--1d8dccb3-e779-4702-aeb1-6627a22cc585",
                    "object_modified": "2025-04-18T18:00:54.754Z"
                },
                {
                    "object_ref": "malware--242622ca-3903-43d5-8aa0-3bbdaa3020ec",
                    "object_modified": "2025-04-18T18:00:54.935Z"
                },
                {
                    "object_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
                    "object_modified": "2025-01-02T19:45:31.402Z"
                },
                {
                    "object_ref": "malware--496bff4d-0700-4b28-b06f-f30a63002be7",
                    "object_modified": "2025-04-18T18:00:55.125Z"
                },
                {
                    "object_ref": "malware--49c04994-1035-4b58-89b7-cf8956e3b423",
                    "object_modified": "2025-04-18T18:00:55.301Z"
                },
                {
                    "object_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
                    "object_modified": "2026-05-12T15:12:00.733Z"
                },
                {
                    "object_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
                    "object_modified": "2023-10-06T14:08:40.134Z"
                },
                {
                    "object_ref": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
                    "object_modified": "2025-04-16T20:38:09.202Z"
                },
                {
                    "object_ref": "malware--58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
                    "object_modified": "2025-04-16T20:38:10.239Z"
                },
                {
                    "object_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
                    "object_modified": "2026-05-12T15:12:00.733Z"
                },
                {
                    "object_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
                    "object_modified": "2025-04-15T19:46:34.471Z"
                },
                {
                    "object_ref": "malware--68dca94f-c11d-421e-9287-7c501108e18c",
                    "object_modified": "2025-04-16T20:38:14.352Z"
                },
                {
                    "object_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
                    "object_modified": "2025-04-16T20:38:14.728Z"
                },
                {
                    "object_ref": "malware--736a3b71-eccc-48b7-b5ed-adb2b74ca830",
                    "object_modified": "2025-04-18T18:00:55.503Z"
                },
                {
                    "object_ref": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
                    "object_modified": "2024-12-09T02:29:13.859Z"
                },
                {
                    "object_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
                    "object_modified": "2026-05-12T15:12:00.736Z"
                },
                {
                    "object_ref": "malware--89ab0ca5-f7e0-4d16-bf2a-17d68117fa4b",
                    "object_modified": "2025-04-18T18:00:55.679Z"
                },
                {
                    "object_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
                    "object_modified": "2024-09-12T14:43:31.224Z"
                },
                {
                    "object_ref": "malware--9e3c9495-5fbd-4676-b3ac-ddecceb57b8f",
                    "object_modified": "2025-04-18T18:00:55.859Z"
                },
                {
                    "object_ref": "malware--a020a61c-423f-4195-8c46-ba1d21abba37",
                    "object_modified": "2025-04-22T22:21:23.589Z"
                },
                {
                    "object_ref": "malware--a4a98eab-b691-45d9-8c48-869ef8fefd57",
                    "object_modified": "2025-04-16T21:26:25.077Z"
                },
                {
                    "object_ref": "malware--ab183324-4634-45bc-98af-9458bb94bcef",
                    "object_modified": "2026-10-09T00:56:40.966Z"
                },
                {
                    "object_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
                    "object_modified": "2025-10-22T02:14:27.600Z"
                },
                {
                    "object_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
                    "object_modified": "2024-11-20T23:33:20.890Z"
                },
                {
                    "object_ref": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
                    "object_modified": "2026-10-12T16:09:31.637Z"
                },
                {
                    "object_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
                    "object_modified": "2026-05-12T15:12:00.739Z"
                },
                {
                    "object_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
                    "object_modified": "2023-10-06T14:09:52.833Z"
                },
                {
                    "object_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
                    "object_modified": "2026-05-12T15:12:00.739Z"
                },
                {
                    "object_ref": "malware--ff6840c9-4c87-4d07-bbb6-9f50aa33d498",
                    "object_modified": "2025-04-16T20:38:46.014Z"
                },
                {
                    "object_ref": "relationship--004d6d78-390b-4969-9e88-8b92d33fbfc0",
                    "object_modified": "2026-04-29T14:23:05.903Z"
                },
                {
                    "object_ref": "relationship--007a2c53-fc5c-4750-aff0-defb282e178a",
                    "object_modified": "2026-04-29T14:23:05.903Z"
                },
                {
                    "object_ref": "relationship--008c7424-73ef-4a99-bcfa-2d96eb7daba0",
                    "object_modified": "2026-04-29T14:23:05.903Z"
                },
                {
                    "object_ref": "relationship--00b9e63b-57a7-408e-83d6-fc03535010a6",
                    "object_modified": "2026-08-04T20:48:44.609Z"
                },
                {
                    "object_ref": "relationship--00cc557e-e1a7-4fdd-b626-2efc73fe510b",
                    "object_modified": "2026-09-25T18:41:20.247Z"
                },
                {
                    "object_ref": "relationship--00e34880-abdb-418d-9252-0433aa40950e",
                    "object_modified": "2026-07-31T20:48:55.792Z"
                },
                {
                    "object_ref": "relationship--00e6c22b-9275-4039-b6d4-2ac0680325d6",
                    "object_modified": "2026-04-29T14:23:05.904Z"
                },
                {
                    "object_ref": "relationship--0105c4f6-a34f-4e0e-964b-a7d108ea3e08",
                    "object_modified": "2026-04-29T14:23:05.904Z"
                },
                {
                    "object_ref": "relationship--011f1d16-c9f1-48ac-94f1-165466c155f8",
                    "object_modified": "2026-04-29T14:23:05.904Z"
                },
                {
                    "object_ref": "relationship--012fd76f-1a10-4e48-9306-10ffae3f61dd",
                    "object_modified": "2026-09-03T20:31:39.195Z"
                },
                {
                    "object_ref": "relationship--01335508-22bb-4185-a7e2-49ec9bee6423",
                    "object_modified": "2026-04-29T14:23:05.904Z"
                },
                {
                    "object_ref": "relationship--01914eb7-9c43-4170-9f0e-f7c2a2c4d396",
                    "object_modified": "2026-09-26T03:00:41.787Z"
                },
                {
                    "object_ref": "relationship--01b4a92f-da42-4dfa-8d59-53709b65940e",
                    "object_modified": "2026-04-29T14:23:05.905Z"
                },
                {
                    "object_ref": "relationship--01c8cc53-dfd0-4afc-8df6-e57494bd9e24",
                    "object_modified": "2026-04-29T14:23:05.905Z"
                },
                {
                    "object_ref": "relationship--02117d44-46d2-41f0-a5fb-ba303e6ee124",
                    "object_modified": "2026-04-29T14:23:05.906Z"
                },
                {
                    "object_ref": "relationship--02186089-b30c-4bb7-8c0f-baae4959e3c1",
                    "object_modified": "2026-10-07T21:53:56.870Z"
                },
                {
                    "object_ref": "relationship--026ba3e5-ae3b-4a8b-83c0-ea8327cd9e50",
                    "object_modified": "2026-04-29T14:23:05.906Z"
                },
                {
                    "object_ref": "relationship--028a3bcc-f299-4061-a0f2-8da85e0a3c81",
                    "object_modified": "2026-04-29T14:23:05.906Z"
                },
                {
                    "object_ref": "relationship--02f547fd-2565-4130-a4be-c4ba7b5aeb0c",
                    "object_modified": "2026-04-29T14:23:05.907Z"
                },
                {
                    "object_ref": "relationship--03181dba-035f-45e6-a5c9-70d02a96e4f4",
                    "object_modified": "2026-04-29T14:23:05.907Z"
                },
                {
                    "object_ref": "relationship--03709641-2bf2-406a-9567-ccf9d0b65017",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--03a9cdc7-3cc5-43e3-9a9c-97d1c4310e35",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--03aab956-54f3-4e4b-93a7-6d1898d91b57",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--03b4dae7-3b20-4ea9-9f7c-6c97582f98b7",
                    "object_modified": "2026-07-31T20:48:14.113Z"
                },
                {
                    "object_ref": "relationship--03d44496-7a15-4e23-820f-b6f1079dbbd3",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--03e1fcda-2007-43f2-aeea-656d3ac13f13",
                    "object_modified": "2026-10-07T21:46:10.287Z"
                },
                {
                    "object_ref": "relationship--03e80e3c-28b9-4e7f-8b17-7c86d1483b91",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--03e94c12-cd51-4f39-a33d-c66a31bbf361",
                    "object_modified": "2026-04-29T14:23:05.908Z"
                },
                {
                    "object_ref": "relationship--0406292e-1288-42ac-b74b-88f5f0a7f1b9",
                    "object_modified": "2026-04-29T14:23:05.909Z"
                },
                {
                    "object_ref": "relationship--042243fd-bfe0-4961-96de-a36232d3ff74",
                    "object_modified": "2026-07-31T20:48:28.307Z"
                },
                {
                    "object_ref": "relationship--046ca7d3-d2d2-458b-bce4-236bc0f207e5",
                    "object_modified": "2026-04-29T14:23:05.909Z"
                },
                {
                    "object_ref": "relationship--04882fef-2a6b-40d0-a101-da9c76a3572e",
                    "object_modified": "2026-04-29T14:23:05.909Z"
                },
                {
                    "object_ref": "relationship--0491ef92-2941-4841-9fe6-2e1809788b52",
                    "object_modified": "2026-04-29T14:23:05.909Z"
                },
                {
                    "object_ref": "relationship--04aad4a8-8b8c-45d9-bb34-508fe4792863",
                    "object_modified": "2026-04-29T14:23:05.909Z"
                },
                {
                    "object_ref": "relationship--04bf72de-75ba-4d95-ad24-f93ad835180c",
                    "object_modified": "2026-04-29T14:23:05.910Z"
                },
                {
                    "object_ref": "relationship--0525121a-0797-4353-98d0-7efc65793157",
                    "object_modified": "2026-04-29T14:23:05.910Z"
                },
                {
                    "object_ref": "relationship--052da7dd-e7c9-4ab3-a8f9-eb734b24ec60",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--058396ca-3af4-444b-b261-74485c47e68c",
                    "object_modified": "2026-04-29T14:23:05.911Z"
                },
                {
                    "object_ref": "relationship--05d18e5c-9c1f-4ee3-95a2-da62bf1c45f8",
                    "object_modified": "2026-04-29T14:23:05.911Z"
                },
                {
                    "object_ref": "relationship--05e82fa8-d762-4b8f-ae07-019e0f24100b",
                    "object_modified": "2026-04-29T14:23:05.911Z"
                },
                {
                    "object_ref": "relationship--061271f5-0d51-4011-9451-532cd1efedbd",
                    "object_modified": "2026-04-29T14:23:05.911Z"
                },
                {
                    "object_ref": "relationship--06257ee1-286f-434f-84b0-f1c083d12e69",
                    "object_modified": "2026-10-07T21:56:08.305Z"
                },
                {
                    "object_ref": "relationship--064dfd6f-db5d-48e8-b350-9dd47a270911",
                    "object_modified": "2026-04-29T14:23:05.912Z"
                },
                {
                    "object_ref": "relationship--0665de34-d5a5-46ae-a0e5-3021bf48c294",
                    "object_modified": "2026-04-20T20:54:17.554Z"
                },
                {
                    "object_ref": "relationship--067932c3-0011-4ca2-9bbe-721c631e4e41",
                    "object_modified": "2026-04-29T14:23:05.912Z"
                },
                {
                    "object_ref": "relationship--06c663f8-fcf1-47eb-ab79-284e93eafa6b",
                    "object_modified": "2026-04-29T14:23:05.912Z"
                },
                {
                    "object_ref": "relationship--0750563d-a86c-4822-ab9c-0f2d3c304c6e",
                    "object_modified": "2026-04-29T14:23:05.913Z"
                },
                {
                    "object_ref": "relationship--076bfea6-309e-4804-a147-dffe93983481",
                    "object_modified": "2026-04-29T14:23:05.913Z"
                },
                {
                    "object_ref": "relationship--077226fd-25b1-4d77-b2e5-d81331ff803b",
                    "object_modified": "2026-04-29T14:23:05.913Z"
                },
                {
                    "object_ref": "relationship--079705ab-c377-4a5b-b9f3-70ed03419ee2",
                    "object_modified": "2026-04-29T14:23:05.914Z"
                },
                {
                    "object_ref": "relationship--079dfa0e-16b1-4d5a-a548-46b53de7cd61",
                    "object_modified": "2026-04-29T14:23:05.914Z"
                },
                {
                    "object_ref": "relationship--07ccd2e1-d4fa-44ff-8d42-95a0942f89d6",
                    "object_modified": "2026-07-31T20:48:16.157Z"
                },
                {
                    "object_ref": "relationship--07e06d21-e666-4274-838a-ef9996fdc0cd",
                    "object_modified": "2026-09-03T20:28:48.731Z"
                },
                {
                    "object_ref": "relationship--07f11dc3-60d7-42d3-a4f0-82eba85dfe44",
                    "object_modified": "2026-04-29T14:23:05.914Z"
                },
                {
                    "object_ref": "relationship--07f4d65d-4572-450f-8cb2-908fee97bd67",
                    "object_modified": "2026-04-29T14:23:05.914Z"
                },
                {
                    "object_ref": "relationship--08302021-aacf-428f-a0ce-e1034d925fb0",
                    "object_modified": "2026-04-29T14:23:05.914Z"
                },
                {
                    "object_ref": "relationship--085c2906-24e2-4bc8-8e5d-fded599d798c",
                    "object_modified": "2026-04-29T14:23:05.915Z"
                },
                {
                    "object_ref": "relationship--085ccfd8-ef5f-41cb-abc7-be5330c60f4e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--0861bf03-eadd-45a4-8490-ae2a2939125b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--095456bc-898b-4c76-a062-ff0ea90aeab4",
                    "object_modified": "2026-04-29T14:23:05.916Z"
                },
                {
                    "object_ref": "relationship--09676502-c50a-47ca-bbef-fffced52346e",
                    "object_modified": "2026-07-31T20:48:54.245Z"
                },
                {
                    "object_ref": "relationship--096c3136-dac9-4729-98c0-c8d870f2bd13",
                    "object_modified": "2026-04-29T14:23:05.916Z"
                },
                {
                    "object_ref": "relationship--096e7743-c090-4386-a759-d749f00bae61",
                    "object_modified": "2026-04-29T14:23:05.916Z"
                },
                {
                    "object_ref": "relationship--098ea270-0a22-4922-a585-412d8ee78390",
                    "object_modified": "2026-04-29T14:23:05.916Z"
                },
                {
                    "object_ref": "relationship--09a96454-505b-4e05-bc0d-41bf791dc926",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--09e0c991-1707-431b-a0fd-fd8215e6d552",
                    "object_modified": "2026-04-29T14:23:05.917Z"
                },
                {
                    "object_ref": "relationship--09e9ed5d-bf32-4aee-8441-774e21ffbdb6",
                    "object_modified": "2026-04-29T14:23:05.917Z"
                },
                {
                    "object_ref": "relationship--0a3b621d-2e88-4392-9963-3fdc40d3cb42",
                    "object_modified": "2026-04-29T14:23:05.917Z"
                },
                {
                    "object_ref": "relationship--0a421699-f013-49f4-9d9f-01d95d210510",
                    "object_modified": "2026-04-29T14:23:05.917Z"
                },
                {
                    "object_ref": "relationship--0a5d2136-e1f5-4a54-be64-a558f918bf0d",
                    "object_modified": "2026-09-03T20:30:36.349Z"
                },
                {
                    "object_ref": "relationship--0aefda29-be77-4660-b7a5-a6430f409914",
                    "object_modified": "2026-04-29T14:23:05.918Z"
                },
                {
                    "object_ref": "relationship--0afaef8a-ed55-4a5b-bbbb-0671a8ffaa79",
                    "object_modified": "2026-04-29T14:23:05.918Z"
                },
                {
                    "object_ref": "relationship--0b2a6fc5-3416-4d78-96cb-f6325c91ab91",
                    "object_modified": "2026-04-29T14:23:05.918Z"
                },
                {
                    "object_ref": "relationship--0b2d0517-9943-413e-a6f9-30c6d5ce8c42",
                    "object_modified": "2026-04-29T14:23:05.918Z"
                },
                {
                    "object_ref": "relationship--0b4198f1-e32d-4430-af65-893d3007be7f",
                    "object_modified": "2026-04-29T14:23:05.919Z"
                },
                {
                    "object_ref": "relationship--0b6cd19f-ee13-4224-9e22-f8a9e626d98f",
                    "object_modified": "2026-04-29T14:23:05.919Z"
                },
                {
                    "object_ref": "relationship--0ba1db3a-389a-4937-975b-d2dc0142cb4b",
                    "object_modified": "2026-04-29T14:23:05.919Z"
                },
                {
                    "object_ref": "relationship--0bc90405-24a9-4f84-a1bb-bf953dbca016",
                    "object_modified": "2026-04-29T14:23:05.919Z"
                },
                {
                    "object_ref": "relationship--0bdfc1b0-3dd2-4170-a39e-98675202a6d2",
                    "object_modified": "2026-04-29T14:23:05.919Z"
                },
                {
                    "object_ref": "relationship--0beb0088-3bea-4612-b2d9-ff9988f829ae",
                    "object_modified": "2026-07-31T20:48:52.967Z"
                },
                {
                    "object_ref": "relationship--0c145fb9-b67d-41ef-94a8-8bd3a5eabd3e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--0c1fe5fc-3bdc-4d0e-94a0-6564f2ce4444",
                    "object_modified": "2026-04-29T14:23:05.920Z"
                },
                {
                    "object_ref": "relationship--0c27087a-623e-4c22-91ce-aa86ea57d7ab",
                    "object_modified": "2026-04-29T14:23:05.920Z"
                },
                {
                    "object_ref": "relationship--0c68501b-8e36-4d75-9e61-7a518a9ca1f2",
                    "object_modified": "2026-04-29T14:23:05.920Z"
                },
                {
                    "object_ref": "relationship--0c72593d-fcc6-4023-8771-bed5e243310e",
                    "object_modified": "2026-04-29T14:23:05.920Z"
                },
                {
                    "object_ref": "relationship--0c7fc84c-ae9f-4359-9570-f3e5faeb0883",
                    "object_modified": "2026-10-07T20:34:06.665Z"
                },
                {
                    "object_ref": "relationship--0cce4090-d079-422c-995e-b4f04b280a7d",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0cd64563-f35e-4cb3-94b9-617c868d3671",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0ce4ccc4-4e9e-4a4b-86d4-3c3838229c3d",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0d379c02-d3bb-4698-b30c-985705a9bfd7",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--0d4f2f88-e176-42c7-8258-52b345045662",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0d52eea3-394e-492b-944b-9ccb6348329d",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0d537021-040f-4592-a3e0-006be5502615",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0d563cbc-b22c-4748-b082-db98bb7f0dab",
                    "object_modified": "2026-04-29T14:23:05.921Z"
                },
                {
                    "object_ref": "relationship--0d8e0324-ba8e-4712-a123-60377afe94da",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0d985b02-cf5f-4307-92ef-9b45eb41bb1b",
                    "object_modified": "2026-07-31T20:48:57.691Z"
                },
                {
                    "object_ref": "relationship--0dbf48f3-4579-4ca2-aceb-19d3e0449136",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0dd31d16-9111-4016-9ebb-412eb577fb79",
                    "object_modified": "2026-09-25T20:34:46.230Z"
                },
                {
                    "object_ref": "relationship--0df0cb6d-0067-48b2-a33e-495415713ab7",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0e0eed7f-1569-4596-9931-bca61a35dc3b",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0e191d66-fe38-4f28-ad82-6922bd6bcc81",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0e29f62d-4ffc-47ec-9623-72f874fbe905",
                    "object_modified": "2026-04-29T14:23:05.922Z"
                },
                {
                    "object_ref": "relationship--0e2b2bef-d9d5-436e-84d5-ffbad6653c80",
                    "object_modified": "2026-10-07T20:07:56.746Z"
                },
                {
                    "object_ref": "relationship--0e4f272b-d744-4feb-9f3f-c24c3598538f",
                    "object_modified": "2026-04-29T14:23:05.923Z"
                },
                {
                    "object_ref": "relationship--0e9d5ca1-5bb1-415f-b31b-d4187d58f4ae",
                    "object_modified": "2026-04-29T14:23:05.924Z"
                },
                {
                    "object_ref": "relationship--0e9d621b-7d0b-4490-b46f-2a671abca251",
                    "object_modified": "2026-04-29T14:23:05.924Z"
                },
                {
                    "object_ref": "relationship--0eb112f6-c1cb-4843-93f5-f668aa0e9bd8",
                    "object_modified": "2026-07-31T20:48:27.988Z"
                },
                {
                    "object_ref": "relationship--0ef1e408-8ebb-4b28-b619-02914b7bae29",
                    "object_modified": "2026-04-29T14:23:05.924Z"
                },
                {
                    "object_ref": "relationship--0f18b876-b698-4f70-aa98-50e8b5a7eae2",
                    "object_modified": "2026-07-31T20:48:52.976Z"
                },
                {
                    "object_ref": "relationship--0f20baa2-20cd-49de-bfa4-5b9765ceacf1",
                    "object_modified": "2026-04-29T14:23:05.924Z"
                },
                {
                    "object_ref": "relationship--0f41614d-c37c-47d1-9616-6dae9b73b532",
                    "object_modified": "2026-04-29T14:23:05.924Z"
                },
                {
                    "object_ref": "relationship--0f5295ce-d705-4541-8dda-c569b126d103",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0f5710a7-f015-40b8-ad3d-f281699f2b72",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0f7a9b56-e3b4-4cc9-9ea7-32faebad74b6",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0f8a6c14-1050-404a-bb6e-4fe107d5b6cd",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0fd7d59d-9622-41c0-8e41-4ac4d1ac6655",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0ff88ef7-44fd-4307-b381-2e0bc76ce83b",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--0ff9310f-6e24-4ad4-b704-8562f7b1b981",
                    "object_modified": "2026-09-26T01:53:21.025Z"
                },
                {
                    "object_ref": "relationship--0ffdee1a-1e83-4506-aba2-38c55812abb3",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--10022aa8-b77b-4173-bcea-bc92d2b9f756",
                    "object_modified": "2026-04-29T14:23:05.925Z"
                },
                {
                    "object_ref": "relationship--10118728-17b8-41a2-b4d6-d8661bc177df",
                    "object_modified": "2026-04-29T14:23:05.926Z"
                },
                {
                    "object_ref": "relationship--102553a8-d57d-4946-a9f0-086ef1683e1d",
                    "object_modified": "2026-04-29T14:23:05.926Z"
                },
                {
                    "object_ref": "relationship--10346185-5437-4317-a9f9-88561a8a1f08",
                    "object_modified": "2026-10-07T17:50:45.384Z"
                },
                {
                    "object_ref": "relationship--104b4f25-d0a9-41f6-94b3-fa85ee8b1523",
                    "object_modified": "2026-04-29T14:23:05.926Z"
                },
                {
                    "object_ref": "relationship--10626671-941d-4a82-a835-56059058ef87",
                    "object_modified": "2026-04-29T14:23:05.926Z"
                },
                {
                    "object_ref": "relationship--106530e1-375a-4ac4-befb-8297b3b05610",
                    "object_modified": "2026-09-03T20:30:36.378Z"
                },
                {
                    "object_ref": "relationship--107d9a23-991b-44f5-97f6-7f6983c7013a",
                    "object_modified": "2026-04-29T14:23:05.926Z"
                },
                {
                    "object_ref": "relationship--10b66db6-5b3d-4b75-b30e-e65a67366462",
                    "object_modified": "2026-09-25T20:33:36.654Z"
                },
                {
                    "object_ref": "relationship--111f437a-c67d-40e4-9515-7e9b22e65eff",
                    "object_modified": "2026-04-29T14:23:05.927Z"
                },
                {
                    "object_ref": "relationship--112ef370-9936-4c3a-9faf-2861600500bd",
                    "object_modified": "2026-04-29T14:23:05.927Z"
                },
                {
                    "object_ref": "relationship--11840b30-f0d1-4df5-a960-cdb80749c32a",
                    "object_modified": "2026-09-03T20:31:39.210Z"
                },
                {
                    "object_ref": "relationship--119aea8f-443f-4831-8143-ec6cd43021cb",
                    "object_modified": "2026-04-20T20:58:48.359Z"
                },
                {
                    "object_ref": "relationship--11a82651-4d69-4738-89c6-17d0243cbbb0",
                    "object_modified": "2026-04-29T14:23:05.928Z"
                },
                {
                    "object_ref": "relationship--11b201bc-675b-46ac-89a6-80f90deecc12",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--11e4eb54-b0b3-4f67-a93f-28cc10df00ab",
                    "object_modified": "2026-04-29T14:23:05.928Z"
                },
                {
                    "object_ref": "relationship--128de3f9-df58-4122-9523-0ac65a6ebf71",
                    "object_modified": "2026-04-29T14:23:05.929Z"
                },
                {
                    "object_ref": "relationship--129a4d3f-fa4a-42c3-833e-8f15155b9693",
                    "object_modified": "2026-07-31T20:48:32.638Z"
                },
                {
                    "object_ref": "relationship--12a6c5bc-c685-4249-b8c6-e6d49aa2b9ed",
                    "object_modified": "2026-04-29T14:23:05.929Z"
                },
                {
                    "object_ref": "relationship--12d6fc4f-bf06-4146-a387-4cb86f0f44a4",
                    "object_modified": "2026-04-29T14:23:05.930Z"
                },
                {
                    "object_ref": "relationship--12e84466-fb05-4d55-9220-5933ee0fcb43",
                    "object_modified": "2026-07-31T20:48:13.499Z"
                },
                {
                    "object_ref": "relationship--12fdacea-28f7-4113-ae67-0b19e1ab5e36",
                    "object_modified": "2026-04-29T14:23:05.930Z"
                },
                {
                    "object_ref": "relationship--135b08ae-715b-4f45-9f03-0d156547e09b",
                    "object_modified": "2026-04-29T14:23:05.930Z"
                },
                {
                    "object_ref": "relationship--137ce4a2-be4c-4eb7-b92c-d686fa2a1044",
                    "object_modified": "2026-04-29T14:23:05.930Z"
                },
                {
                    "object_ref": "relationship--13809e98-1d74-4c39-b882-9d523c76cbde",
                    "object_modified": "2026-04-29T14:23:05.931Z"
                },
                {
                    "object_ref": "relationship--13a0693c-6297-4221-babc-c8cfce904b13",
                    "object_modified": "2026-09-25T20:12:44.653Z"
                },
                {
                    "object_ref": "relationship--13cfe7cd-6ee4-4d8c-8c3e-b115686b7da7",
                    "object_modified": "2026-04-29T14:23:05.931Z"
                },
                {
                    "object_ref": "relationship--13d76624-7049-45c5-94d3-8f172b7f6336",
                    "object_modified": "2026-09-03T20:28:48.759Z"
                },
                {
                    "object_ref": "relationship--14055bc9-dc7c-47db-b541-77d05d486018",
                    "object_modified": "2026-04-29T14:23:05.931Z"
                },
                {
                    "object_ref": "relationship--14178a60-b894-4186-b83b-5ffd043f4cfc",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--1429cd78-4e2a-4898-a7d8-d01a0c465bd6",
                    "object_modified": "2026-04-29T14:23:05.931Z"
                },
                {
                    "object_ref": "relationship--144f6ce7-d2b2-4a76-85d2-251191a0d2cc",
                    "object_modified": "2026-04-29T14:23:05.932Z"
                },
                {
                    "object_ref": "relationship--14c73603-a6d2-4a8d-9904-0f8249aaa495",
                    "object_modified": "2026-09-03T20:28:48.779Z"
                },
                {
                    "object_ref": "relationship--152dbbf5-b069-4784-aabd-c50e2fd6bd53",
                    "object_modified": "2026-04-29T14:23:05.933Z"
                },
                {
                    "object_ref": "relationship--1531a280-e280-465c-826d-ce357935a89c",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--15377914-bf08-4c7e-ab00-1e272e2f3c1a",
                    "object_modified": "2026-04-29T14:23:05.933Z"
                },
                {
                    "object_ref": "relationship--1582107d-95dd-41ba-b2c0-72200b93a292",
                    "object_modified": "2026-07-31T20:48:19.449Z"
                },
                {
                    "object_ref": "relationship--159fb736-ba92-4564-aa6d-db6f64497763",
                    "object_modified": "2026-04-29T14:23:05.933Z"
                },
                {
                    "object_ref": "relationship--165e3427-8738-4a89-9964-4593c671e855",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--1673b2e2-7799-4b5f-b5a9-2c51426a6916",
                    "object_modified": "2026-07-31T20:48:17.817Z"
                },
                {
                    "object_ref": "relationship--16ac0172-02d1-4fda-99c0-61f1cef7dc4b",
                    "object_modified": "2026-04-29T14:23:05.935Z"
                },
                {
                    "object_ref": "relationship--16b74b29-e3b3-49ff-9ff4-cd7ade0f8ff4",
                    "object_modified": "2026-04-29T14:23:05.935Z"
                },
                {
                    "object_ref": "relationship--16b92a53-7334-42b1-bc55-dcd4907fdd9f",
                    "object_modified": "2026-04-29T14:23:05.935Z"
                },
                {
                    "object_ref": "relationship--16c7240e-0559-4c49-9003-1bfe97074252",
                    "object_modified": "2026-04-29T14:23:05.935Z"
                },
                {
                    "object_ref": "relationship--16cca881-cf8b-4651-9ab1-cc8507cadd58",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--16fe0039-b992-4432-a692-b30bb034e353",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--171ed9c4-35f4-4674-b52d-d920c1a08912",
                    "object_modified": "2026-04-29T14:23:05.936Z"
                },
                {
                    "object_ref": "relationship--172e0537-7a9c-4610-9b07-32a841f0bd8d",
                    "object_modified": "2026-06-12T16:00:28.144Z"
                },
                {
                    "object_ref": "relationship--1736df4d-188e-4a44-a8b3-6c6cd71dc749",
                    "object_modified": "2026-04-29T14:23:05.936Z"
                },
                {
                    "object_ref": "relationship--17925772-5935-4f50-bf0e-abb5e0bad6b3",
                    "object_modified": "2026-04-29T14:23:05.936Z"
                },
                {
                    "object_ref": "relationship--17ae41a5-cb45-4935-bec1-ea0c8bfb2f34",
                    "object_modified": "2026-04-29T14:23:05.937Z"
                },
                {
                    "object_ref": "relationship--17fd7ffd-63d9-4e1e-8b19-38095b2d65ab",
                    "object_modified": "2026-04-29T14:23:05.937Z"
                },
                {
                    "object_ref": "relationship--182010e6-59c2-42f5-91c7-510891a96483",
                    "object_modified": "2026-04-29T14:23:05.937Z"
                },
                {
                    "object_ref": "relationship--1865830b-511d-4302-99f7-6143647a8e40",
                    "object_modified": "2026-04-29T14:23:05.938Z"
                },
                {
                    "object_ref": "relationship--186bd80c-9e22-4e3d-9515-dbe5c89892fe",
                    "object_modified": "2026-09-26T04:58:02.143Z"
                },
                {
                    "object_ref": "relationship--186ec539-6387-44a7-9354-3e524cedd495",
                    "object_modified": "2026-10-07T19:38:36.023Z"
                },
                {
                    "object_ref": "relationship--18a562d1-0118-4675-9d66-8e9cc138dd43",
                    "object_modified": "2026-04-29T14:23:05.938Z"
                },
                {
                    "object_ref": "relationship--18ab56e8-79ce-481d-9ab4-e558fbfb5ac5",
                    "object_modified": "2026-07-31T20:48:17.827Z"
                },
                {
                    "object_ref": "relationship--18af193c-160a-4cae-9078-4d69de5c2347",
                    "object_modified": "2026-04-29T14:23:05.938Z"
                },
                {
                    "object_ref": "relationship--18af4cd0-5941-4754-86b8-5d2389fd5524",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--18cb8770-09ab-48aa-8ead-b3d0030e47dc",
                    "object_modified": "2026-09-03T20:28:48.834Z"
                },
                {
                    "object_ref": "relationship--18cdfacf-4eba-4049-b85f-d1cab5106c75",
                    "object_modified": "2026-04-29T14:23:05.938Z"
                },
                {
                    "object_ref": "relationship--18ef2d69-d11a-4d31-a803-da989c4073f7",
                    "object_modified": "2026-04-29T14:23:05.938Z"
                },
                {
                    "object_ref": "relationship--1992737e-0df0-43c6-8a43-85bf3802e470",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--19ab6776-42de-48af-975a-568d31a3bb66",
                    "object_modified": "2026-04-29T14:23:05.940Z"
                },
                {
                    "object_ref": "relationship--19dee45d-8c24-41ac-976f-aeb221c4f658",
                    "object_modified": "2026-10-09T02:43:26.360Z"
                },
                {
                    "object_ref": "relationship--19df16da-8247-45ef-be13-ba58b1fb9c1c",
                    "object_modified": "2026-04-29T14:23:05.940Z"
                },
                {
                    "object_ref": "relationship--19e9b914-3cb9-430c-ae02-f8e93fc2d826",
                    "object_modified": "2026-04-29T14:23:05.940Z"
                },
                {
                    "object_ref": "relationship--1a3ecee5-0237-4e01-8f02-90092c15a2f0",
                    "object_modified": "2026-09-03T20:30:36.437Z"
                },
                {
                    "object_ref": "relationship--1a40cec9-47c3-404e-b039-b7ae83ffaf68",
                    "object_modified": "2026-04-29T14:23:05.940Z"
                },
                {
                    "object_ref": "relationship--1a415b2d-3930-40be-b1f0-c6b47bb3e8ad",
                    "object_modified": "2026-10-07T19:39:21.554Z"
                },
                {
                    "object_ref": "relationship--1a6d5c5a-c1ac-41a6-8b6e-0d5df81b219f",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1a900ac4-c150-4b57-a899-990854b01d4b",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1a96ad0d-84df-4b6b-ba4c-8559de5ec356",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1a9ca148-a456-4b66-805f-a2bdfc7a947d",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1aa02c37-973e-46bd-ab45-609463e514e9",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1af5c5bb-0d97-4c0a-9174-4dee1ff8b185",
                    "object_modified": "2026-04-29T14:23:05.941Z"
                },
                {
                    "object_ref": "relationship--1b36c370-6e82-4c2f-936d-a6fe8aafc73d",
                    "object_modified": "2026-04-29T14:23:05.942Z"
                },
                {
                    "object_ref": "relationship--1ba485c9-951e-4e07-8e69-1d0efc372f6b",
                    "object_modified": "2026-04-29T14:23:05.942Z"
                },
                {
                    "object_ref": "relationship--1bb30143-97e5-4bbd-9c2b-1d8de70aa10c",
                    "object_modified": "2026-04-29T14:23:05.942Z"
                },
                {
                    "object_ref": "relationship--1bb7b8cf-b584-427c-97e8-e4b60750d308",
                    "object_modified": "2026-04-20T20:54:20.114Z"
                },
                {
                    "object_ref": "relationship--1bea0610-432c-4cd7-8e0e-8b7bbd09d738",
                    "object_modified": "2026-04-29T14:23:05.943Z"
                },
                {
                    "object_ref": "relationship--1c3d966a-5995-48ed-919d-25b972010fe9",
                    "object_modified": "2026-04-29T14:23:05.943Z"
                },
                {
                    "object_ref": "relationship--1c7df4f1-cee5-42c6-a974-29552552666f",
                    "object_modified": "2026-04-29T14:23:05.943Z"
                },
                {
                    "object_ref": "relationship--1c831708-28c2-47ae-a158-39f1f7b73406",
                    "object_modified": "2026-04-29T14:23:05.943Z"
                },
                {
                    "object_ref": "relationship--1cb7bae3-c3d7-43ba-8e51-3fd4d13b7680",
                    "object_modified": "2026-04-29T14:23:05.944Z"
                },
                {
                    "object_ref": "relationship--1ccc0e03-1ea1-4916-ac6e-a1fb0366db19",
                    "object_modified": "2026-10-07T21:45:38.653Z"
                },
                {
                    "object_ref": "relationship--1cf89a8b-c0f6-4ffb-ae39-36e2a9d3b081",
                    "object_modified": "2026-04-29T14:23:05.944Z"
                },
                {
                    "object_ref": "relationship--1d0daee9-621c-47c8-b9f3-3b9a6dc5ea13",
                    "object_modified": "2026-04-29T14:23:05.944Z"
                },
                {
                    "object_ref": "relationship--1d35c947-447f-4693-9ab0-32dff56e664e",
                    "object_modified": "2026-04-29T14:23:05.944Z"
                },
                {
                    "object_ref": "relationship--1d637465-fa54-4962-aa2d-cb0d04dfec0a",
                    "object_modified": "2026-09-03T20:30:36.457Z"
                },
                {
                    "object_ref": "relationship--1d6fa472-a1fe-4657-a60d-c7f1c39b1653",
                    "object_modified": "2026-04-29T14:23:05.945Z"
                },
                {
                    "object_ref": "relationship--1dad5efc-395f-4b92-8f4f-3e987a4d5e57",
                    "object_modified": "2026-08-04T20:48:44.732Z"
                },
                {
                    "object_ref": "relationship--1dc35f79-0ada-4342-bd13-10d10c1b0335",
                    "object_modified": "2026-04-29T14:23:05.945Z"
                },
                {
                    "object_ref": "relationship--1dd94603-3686-4dd5-b0be-2cdc43b0c1fb",
                    "object_modified": "2026-04-29T14:23:05.945Z"
                },
                {
                    "object_ref": "relationship--1ddb73e6-b7a8-4f4d-bf8b-f9de3a5ef52a",
                    "object_modified": "2026-04-29T14:23:05.945Z"
                },
                {
                    "object_ref": "relationship--1efbe3b3-4e8d-4f3f-b9f9-098c85840e33",
                    "object_modified": "2026-04-29T14:23:05.947Z"
                },
                {
                    "object_ref": "relationship--1f393d04-36db-4bae-a2a4-53ff12a1240e",
                    "object_modified": "2026-04-29T14:23:05.947Z"
                },
                {
                    "object_ref": "relationship--1f87378c-49fb-4da5-8ed3-3672633d3713",
                    "object_modified": "2026-04-29T14:23:05.947Z"
                },
                {
                    "object_ref": "relationship--1f886c01-1fff-452e-bb24-009c91be9b69",
                    "object_modified": "2026-04-20T20:54:18.047Z"
                },
                {
                    "object_ref": "relationship--1f8abf6f-0dd0-4449-b555-733fe7296177",
                    "object_modified": "2026-04-29T14:23:05.947Z"
                },
                {
                    "object_ref": "relationship--1fc147bd-d6ab-4beb-908b-0fbe8e125b76",
                    "object_modified": "2026-04-29T14:23:05.948Z"
                },
                {
                    "object_ref": "relationship--1fd4cf4e-a26c-4fe5-a7fd-f49b8aea8437",
                    "object_modified": "2026-04-29T14:23:05.948Z"
                },
                {
                    "object_ref": "relationship--1fd5badc-0e9f-462c-9738-550e7e8d8ae3",
                    "object_modified": "2026-04-29T14:23:05.948Z"
                },
                {
                    "object_ref": "relationship--20006064-4e2f-4106-a6b4-ee8b4c739c9b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--20031e48-2258-4901-ac21-bffd7191e931",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--2031d3aa-840e-4a6b-b0be-155f41c7d70e",
                    "object_modified": "2026-10-07T20:36:14.752Z"
                },
                {
                    "object_ref": "relationship--2049ea95-0a5e-4b85-87c6-a8307d4cf738",
                    "object_modified": "2026-09-26T01:58:36.987Z"
                },
                {
                    "object_ref": "relationship--2087b2b9-3b30-45be-abcd-4320bf0fa66b",
                    "object_modified": "2026-04-29T14:23:05.949Z"
                },
                {
                    "object_ref": "relationship--2089201c-c1c6-4d92-a737-a6499e26ee7f",
                    "object_modified": "2026-04-29T14:23:05.949Z"
                },
                {
                    "object_ref": "relationship--208fe57b-cf2e-4188-8a6f-77597cd60351",
                    "object_modified": "2026-04-29T14:23:05.949Z"
                },
                {
                    "object_ref": "relationship--20913dc0-33cc-43f8-bd34-a2f9a4a5fbd3",
                    "object_modified": "2026-04-29T14:23:05.949Z"
                },
                {
                    "object_ref": "relationship--2091a0be-48ce-4d5c-963b-8ba2842b57e3",
                    "object_modified": "2026-04-29T14:23:05.949Z"
                },
                {
                    "object_ref": "relationship--20a0d820-59ef-42fc-9f56-7a93d1ce7a84",
                    "object_modified": "2026-09-03T20:28:48.867Z"
                },
                {
                    "object_ref": "relationship--20f66fab-7a08-4707-ac79-92dac5acd11d",
                    "object_modified": "2026-04-29T14:23:05.950Z"
                },
                {
                    "object_ref": "relationship--21041206-da58-45c7-adb0-db07caebdcb6",
                    "object_modified": "2026-04-29T14:23:05.950Z"
                },
                {
                    "object_ref": "relationship--21058f32-3d6e-4381-9288-5c2248e84cce",
                    "object_modified": "2026-04-29T14:23:05.950Z"
                },
                {
                    "object_ref": "relationship--2138f4ee-5111-4469-92bb-1fc82a6822b4",
                    "object_modified": "2026-04-29T14:23:05.950Z"
                },
                {
                    "object_ref": "relationship--21470001-67f2-47cf-af21-784e5024ac1d",
                    "object_modified": "2026-04-29T14:23:05.950Z"
                },
                {
                    "object_ref": "relationship--2159458f-87fc-4479-81f4-a2521a378221",
                    "object_modified": "2026-09-03T20:30:36.489Z"
                },
                {
                    "object_ref": "relationship--21aa6331-3419-4049-b180-8349b71e1f2a",
                    "object_modified": "2026-04-29T14:23:05.951Z"
                },
                {
                    "object_ref": "relationship--21b6ec9c-8779-49db-bf19-90e81893a6e4",
                    "object_modified": "2026-04-29T14:23:05.951Z"
                },
                {
                    "object_ref": "relationship--21c7b1bb-ba40-4843-b462-079b1b85c01b",
                    "object_modified": "2026-04-29T14:23:05.951Z"
                },
                {
                    "object_ref": "relationship--21ccb883-2961-4b3a-9e1a-4439190aea49",
                    "object_modified": "2026-09-26T05:08:18.533Z"
                },
                {
                    "object_ref": "relationship--21e0e769-cc74-4e3b-8f88-072ebf8eaaf2",
                    "object_modified": "2026-04-29T14:23:05.951Z"
                },
                {
                    "object_ref": "relationship--220140ac-d927-4d86-9335-c04aa6ee3c61",
                    "object_modified": "2026-04-29T14:23:05.951Z"
                },
                {
                    "object_ref": "relationship--22401c3f-f64f-4ee6-94ee-24fe108b595a",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--22448288-32d9-4d2c-be16-0784e119fff1",
                    "object_modified": "2026-04-29T14:23:05.952Z"
                },
                {
                    "object_ref": "relationship--22548926-29b4-4882-9878-633375489c0e",
                    "object_modified": "2026-04-29T14:23:05.952Z"
                },
                {
                    "object_ref": "relationship--2287eabb-5349-4d3e-938a-7d6023d7e02c",
                    "object_modified": "2026-04-29T14:23:05.952Z"
                },
                {
                    "object_ref": "relationship--2289f005-7863-4af5-b681-cdfc03d3f111",
                    "object_modified": "2026-09-03T20:28:48.885Z"
                },
                {
                    "object_ref": "relationship--228b9a13-0545-4ecf-99ff-be02addaf7fe",
                    "object_modified": "2026-04-29T14:23:05.952Z"
                },
                {
                    "object_ref": "relationship--22ae18ec-d856-483c-a2ab-9db0739b0475",
                    "object_modified": "2026-04-20T20:54:19.543Z"
                },
                {
                    "object_ref": "relationship--232c7049-7609-46a9-8bbe-38672713f853",
                    "object_modified": "2026-04-29T14:23:05.953Z"
                },
                {
                    "object_ref": "relationship--2346cbf5-b3c8-4110-a66c-6194251d4d49",
                    "object_modified": "2026-04-29T14:23:05.953Z"
                },
                {
                    "object_ref": "relationship--23564002-f836-4da6-a083-e086a606f0eb",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--2361ff8c-68a1-4899-a046-ba1b083272de",
                    "object_modified": "2026-04-20T20:54:23.490Z"
                },
                {
                    "object_ref": "relationship--23851bda-49de-4f35-979f-c4e6b5742389",
                    "object_modified": "2026-04-29T14:23:05.953Z"
                },
                {
                    "object_ref": "relationship--238f967a-0c29-4aa3-bbb5-3dc593473bbf",
                    "object_modified": "2026-04-29T14:23:05.953Z"
                },
                {
                    "object_ref": "relationship--23f33619-c64e-4999-85c1-b5c88e570e46",
                    "object_modified": "2026-04-29T14:23:05.954Z"
                },
                {
                    "object_ref": "relationship--242b5a0d-e4e8-4ceb-a975-cf8efd64e981",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--243ad7b2-546c-4bf2-a3c0-1438b13e197d",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--2445124d-1fc9-49ad-8715-96053f39d717",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--2452cc82-6ee0-4a98-a213-d5e3f3247e07",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--245c8c36-28e5-4508-a585-7768cb33299a",
                    "object_modified": "2026-07-31T20:48:16.167Z"
                },
                {
                    "object_ref": "relationship--246ba662-bd89-4295-b603-582ebad285da",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--24793eaf-f0d8-4baf-ba3d-900b87cf464d",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--24d17e8f-0c0f-41d1-aa83-8b69b8d30be5",
                    "object_modified": "2026-04-29T14:23:05.955Z"
                },
                {
                    "object_ref": "relationship--24e1f6cf-44c3-4a3f-9839-5cd6398cc0fe",
                    "object_modified": "2026-04-29T14:23:05.956Z"
                },
                {
                    "object_ref": "relationship--250212f0-a149-4a14-af83-94f7fcedc021",
                    "object_modified": "2026-04-29T14:23:05.956Z"
                },
                {
                    "object_ref": "relationship--25095116-7b71-4a6d-8a98-b60adff61372",
                    "object_modified": "2026-07-31T20:48:54.942Z"
                },
                {
                    "object_ref": "relationship--25281488-be20-4d83-89d1-1da7ea836037",
                    "object_modified": "2026-04-29T14:23:05.956Z"
                },
                {
                    "object_ref": "relationship--25ddb2e0-b945-45d2-a8a9-6e6d5c4401d3",
                    "object_modified": "2026-04-29T14:23:05.957Z"
                },
                {
                    "object_ref": "relationship--25e7ca82-2784-433a-90a9-a3483615a655",
                    "object_modified": "2026-07-31T20:48:46.507Z"
                },
                {
                    "object_ref": "relationship--268b9429-b1c6-4bc3-84cf-8512e8ef57a7",
                    "object_modified": "2026-07-31T20:48:16.175Z"
                },
                {
                    "object_ref": "relationship--26bb65a5-a5c4-4a6a-9bdb-982abf425b49",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--26fdd07e-d194-4f8e-a9af-d5b2f1d0222e",
                    "object_modified": "2026-04-29T14:23:05.958Z"
                },
                {
                    "object_ref": "relationship--2711edd1-6042-4fec-9ba6-bc8653b6ca64",
                    "object_modified": "2026-10-07T21:53:04.761Z"
                },
                {
                    "object_ref": "relationship--274994e7-1fe9-463a-9979-46c72107bf9b",
                    "object_modified": "2026-04-29T14:23:05.958Z"
                },
                {
                    "object_ref": "relationship--275fe31f-e6d5-4fab-8f63-a53063f84e68",
                    "object_modified": "2026-10-07T19:39:34.780Z"
                },
                {
                    "object_ref": "relationship--276aa6a6-e700-470a-8f72-02537ba7be9d",
                    "object_modified": "2026-04-29T14:23:05.958Z"
                },
                {
                    "object_ref": "relationship--276f561b-5a3e-496e-a591-d4d465e80e29",
                    "object_modified": "2026-09-25T20:12:13.446Z"
                },
                {
                    "object_ref": "relationship--278cf882-835f-4e65-a8fc-bb8956dcbea0",
                    "object_modified": "2026-04-29T14:23:05.959Z"
                },
                {
                    "object_ref": "relationship--27cac33f-cb57-45ff-8312-5ebac2e22396",
                    "object_modified": "2026-04-29T14:23:05.959Z"
                },
                {
                    "object_ref": "relationship--27f87692-30c1-4693-b209-fdc78382badd",
                    "object_modified": "2026-04-29T14:23:05.959Z"
                },
                {
                    "object_ref": "relationship--28134bdf-ddb3-4c34-b015-9af56898e646",
                    "object_modified": "2026-10-07T20:36:24.340Z"
                },
                {
                    "object_ref": "relationship--282731bc-968f-432a-937a-0343f3a8ba35",
                    "object_modified": "2026-04-29T14:23:05.959Z"
                },
                {
                    "object_ref": "relationship--283cbc1b-e998-4b44-81d1-c39f1f45b2bd",
                    "object_modified": "2026-09-26T05:10:45.992Z"
                },
                {
                    "object_ref": "relationship--283d4fdb-f5db-4947-85d6-80b5de55d0c0",
                    "object_modified": "2026-09-25T18:42:50.630Z"
                },
                {
                    "object_ref": "relationship--2867f491-919b-463f-b689-bb3ceb7ae99f",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--287b247f-8ec3-4d8d-a521-050ac8c791ad",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--287b2ad4-e455-45f1-ae03-c0605ef5b1cd",
                    "object_modified": "2026-10-07T20:36:37.339Z"
                },
                {
                    "object_ref": "relationship--28afd84d-a53e-4b2f-9bee-133f7da6982a",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--28b06a92-2933-49f5-887e-c09cf1bb861f",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--28bb99c4-ac44-406c-bd5d-cabb273363fb",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--28d4feb4-7a87-4376-8401-d579f830472b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--28e89bca-04a2-462f-9d84-d5dc4d55d98e",
                    "object_modified": "2026-04-29T14:23:05.960Z"
                },
                {
                    "object_ref": "relationship--29397fec-dc16-4407-81a2-9e53cc082570",
                    "object_modified": "2026-04-29T14:23:05.961Z"
                },
                {
                    "object_ref": "relationship--2971151c-0e8a-4567-84dc-01cf5dd35005",
                    "object_modified": "2026-04-29T14:23:05.961Z"
                },
                {
                    "object_ref": "relationship--29c2757d-c5f6-4c8d-bbdd-3629cb14dd81",
                    "object_modified": "2026-04-29T14:23:05.962Z"
                },
                {
                    "object_ref": "relationship--29ebbcee-3c41-42e1-8a3e-1c6678ca5ece",
                    "object_modified": "2026-04-29T14:23:05.962Z"
                },
                {
                    "object_ref": "relationship--2a451896-81aa-4eed-a444-4d04661adeeb",
                    "object_modified": "2026-04-29T14:23:05.962Z"
                },
                {
                    "object_ref": "relationship--2aaa6840-47fc-455c-9b19-1d27c3afccbe",
                    "object_modified": "2026-09-03T20:28:48.896Z"
                },
                {
                    "object_ref": "relationship--2ad5f781-1f7c-4bb9-984a-9299a307132f",
                    "object_modified": "2026-04-29T14:23:05.963Z"
                },
                {
                    "object_ref": "relationship--2b2871ae-e8e6-429e-b9e3-91852d1c5cb8",
                    "object_modified": "2026-09-26T03:36:10.758Z"
                },
                {
                    "object_ref": "relationship--2b62e4c0-9267-47bd-8f4d-0394b13fb566",
                    "object_modified": "2026-04-29T14:23:05.964Z"
                },
                {
                    "object_ref": "relationship--2b7d57d7-3802-4b59-99c6-1e1597fe78d1",
                    "object_modified": "2026-04-29T14:23:05.964Z"
                },
                {
                    "object_ref": "relationship--2bfb3a93-422c-4a36-a9c2-c5a9e79477d8",
                    "object_modified": "2026-09-26T03:00:05.537Z"
                },
                {
                    "object_ref": "relationship--2c1510bc-99d2-43d6-a58c-585d2dab485e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--2c479e7e-422c-4329-8fb9-4484e2fdbf9c",
                    "object_modified": "2026-10-08T23:59:22.450Z"
                },
                {
                    "object_ref": "relationship--2c6c4752-536e-4b96-86d7-7efe88350082",
                    "object_modified": "2026-04-29T14:23:05.965Z"
                },
                {
                    "object_ref": "relationship--2c79920a-f2d1-4114-a1df-924835da645c",
                    "object_modified": "2026-04-29T14:23:05.965Z"
                },
                {
                    "object_ref": "relationship--2caa292a-4d54-4efb-bf79-79ce5c7a962c",
                    "object_modified": "2026-10-07T20:37:02.606Z"
                },
                {
                    "object_ref": "relationship--2cd79563-0f5a-44a1-9be4-6dc330855d64",
                    "object_modified": "2026-04-29T14:23:05.965Z"
                },
                {
                    "object_ref": "relationship--2ce3d5d3-6575-4b4c-a67c-64fb31974540",
                    "object_modified": "2026-04-29T14:23:05.965Z"
                },
                {
                    "object_ref": "relationship--2d0bed1d-342b-44a0-aec8-e6d7c6596fa2",
                    "object_modified": "2026-04-29T14:23:05.966Z"
                },
                {
                    "object_ref": "relationship--2d17672c-ceaf-4fbb-8f3e-a00996b240c8",
                    "object_modified": "2026-07-31T20:48:19.533Z"
                },
                {
                    "object_ref": "relationship--2d312430-66d1-4549-a5f9-47abc2730e43",
                    "object_modified": "2026-04-29T14:23:05.966Z"
                },
                {
                    "object_ref": "relationship--2d3548a6-37ca-4105-b4e8-7c233d29d17f",
                    "object_modified": "2026-10-07T21:46:20.554Z"
                },
                {
                    "object_ref": "relationship--2d621264-4a6d-4bc7-abaf-89a89c2ef813",
                    "object_modified": "2026-04-29T14:23:05.966Z"
                },
                {
                    "object_ref": "relationship--2daeeaaa-5b4b-4bb7-a94d-78a5749027ca",
                    "object_modified": "2026-04-29T14:23:05.966Z"
                },
                {
                    "object_ref": "relationship--2dc39956-05d1-4dd5-86db-cb70568d73fe",
                    "object_modified": "2026-04-29T14:23:05.966Z"
                },
                {
                    "object_ref": "relationship--2dd1d205-55e4-4226-9221-5839f2268e57",
                    "object_modified": "2026-07-31T20:48:19.546Z"
                },
                {
                    "object_ref": "relationship--2de38f5e-b97c-498a-a4c9-f13e5d2d233c",
                    "object_modified": "2026-04-29T14:23:05.967Z"
                },
                {
                    "object_ref": "relationship--2de9fc26-3c9b-4ecf-b613-795586f5414b",
                    "object_modified": "2026-10-07T22:07:21.684Z"
                },
                {
                    "object_ref": "relationship--2e32e0fd-24cf-4a41-b56d-98ada9f1db8a",
                    "object_modified": "2026-04-29T14:23:05.967Z"
                },
                {
                    "object_ref": "relationship--2e5f338d-92c4-4647-8fef-7c901ff774f5",
                    "object_modified": "2026-04-29T14:23:05.967Z"
                },
                {
                    "object_ref": "relationship--2e9a021d-6dbe-4ee5-a98b-041bb13d2836",
                    "object_modified": "2026-04-29T14:23:05.967Z"
                },
                {
                    "object_ref": "relationship--2ecc567f-3aaa-4bd8-935f-4808d177a552",
                    "object_modified": "2026-04-29T14:23:05.968Z"
                },
                {
                    "object_ref": "relationship--2ecf9476-b546-44ff-8547-4ca56cf7eeb8",
                    "object_modified": "2026-04-29T14:23:05.968Z"
                },
                {
                    "object_ref": "relationship--2f0d1a71-7cb6-4979-b072-a859d117d47f",
                    "object_modified": "2026-08-04T20:48:44.763Z"
                },
                {
                    "object_ref": "relationship--2f15fa70-7e2d-4ef3-9654-0404e71ac343",
                    "object_modified": "2026-04-29T14:23:05.969Z"
                },
                {
                    "object_ref": "relationship--2f457bef-1721-4e0f-b236-24e4652a31b4",
                    "object_modified": "2026-04-29T14:23:05.970Z"
                },
                {
                    "object_ref": "relationship--2f6b635b-1441-4ef0-9289-1ed6b9098d4a",
                    "object_modified": "2026-04-29T14:23:05.971Z"
                },
                {
                    "object_ref": "relationship--2f7c49a0-89fe-4d18-915c-c321868d47bd",
                    "object_modified": "2026-04-29T14:23:05.971Z"
                },
                {
                    "object_ref": "relationship--2f8c9deb-aefe-4fa3-b00c-ec15fd154233",
                    "object_modified": "2026-04-29T14:23:05.972Z"
                },
                {
                    "object_ref": "relationship--2f9c25af-d2e2-4793-85bf-6e2696384a50",
                    "object_modified": "2026-04-29T14:23:05.974Z"
                },
                {
                    "object_ref": "relationship--2fbb7867-79c5-4d45-9876-98c4041dd72e",
                    "object_modified": "2026-04-29T14:23:05.974Z"
                },
                {
                    "object_ref": "relationship--2fd13fc0-e3f0-4099-ab20-d19ba6bcd4e0",
                    "object_modified": "2026-04-29T14:23:05.975Z"
                },
                {
                    "object_ref": "relationship--2fd35996-196f-4a58-9dab-07f52c74f4d3",
                    "object_modified": "2026-04-20T20:54:17.065Z"
                },
                {
                    "object_ref": "relationship--2fd8a76f-4663-4251-a16d-e1f105a854f9",
                    "object_modified": "2026-04-29T14:23:05.975Z"
                },
                {
                    "object_ref": "relationship--2ff351dc-5b86-4a5b-b0f0-7ac1af8f891f",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--2ff82993-5010-4450-89e7-341f449f3263",
                    "object_modified": "2026-04-29T14:23:05.975Z"
                },
                {
                    "object_ref": "relationship--3003564d-fb12-4509-946b-818e4e5b8431",
                    "object_modified": "2026-04-29T14:23:05.976Z"
                },
                {
                    "object_ref": "relationship--30227ffe-9019-4fed-9ee2-e4cfba77e3ec",
                    "object_modified": "2026-04-29T14:23:05.976Z"
                },
                {
                    "object_ref": "relationship--305866af-1f36-49e0-a57d-d5faaf29011c",
                    "object_modified": "2026-04-29T14:23:05.977Z"
                },
                {
                    "object_ref": "relationship--3066ddc9-b4e8-41b6-a28f-9de5030cb714",
                    "object_modified": "2026-07-31T20:48:56.058Z"
                },
                {
                    "object_ref": "relationship--309e4558-e591-4d03-9bb9-07d30acf011f",
                    "object_modified": "2026-04-29T14:23:05.978Z"
                },
                {
                    "object_ref": "relationship--31402349-2c5a-4811-addd-a345801836ac",
                    "object_modified": "2026-09-25T18:42:15.991Z"
                },
                {
                    "object_ref": "relationship--314a1b91-167a-4ad5-a36b-8bbdbd286540",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--31563b1f-37d8-4399-bd0c-9c93445f87d9",
                    "object_modified": "2026-10-07T19:37:53.692Z"
                },
                {
                    "object_ref": "relationship--316110bc-9b4c-41e4-96eb-d8051a4fda6c",
                    "object_modified": "2026-04-29T14:23:05.981Z"
                },
                {
                    "object_ref": "relationship--316279ab-7d07-4159-8021-d2f38e6d5b01",
                    "object_modified": "2026-10-07T19:37:30.093Z"
                },
                {
                    "object_ref": "relationship--317ce6a3-7767-4be3-a201-004368f1b2ec",
                    "object_modified": "2026-04-29T14:23:05.981Z"
                },
                {
                    "object_ref": "relationship--31897c41-1d47-4a34-b531-21c3f74651a8",
                    "object_modified": "2026-04-29T14:23:05.981Z"
                },
                {
                    "object_ref": "relationship--31b8d0d3-2e81-4367-80c0-1173988e77d7",
                    "object_modified": "2026-04-29T14:23:05.982Z"
                },
                {
                    "object_ref": "relationship--31bf1721-78a2-4b6c-b325-5c44dc02ea33",
                    "object_modified": "2026-07-31T20:48:46.548Z"
                },
                {
                    "object_ref": "relationship--31e67caf-6b34-4651-96fc-5b97609c843a",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--321dfef3-01bf-40ee-901e-6354b945c31a",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--32438a90-406c-40f7-a5ac-a1ca92cd51d5",
                    "object_modified": "2026-04-29T14:23:05.984Z"
                },
                {
                    "object_ref": "relationship--327916f7-fe5d-4858-adeb-f72f74c60c25",
                    "object_modified": "2026-09-03T20:31:39.225Z"
                },
                {
                    "object_ref": "relationship--327f65bc-8a33-4dbb-88d4-714a9e42442b",
                    "object_modified": "2026-04-29T14:23:05.985Z"
                },
                {
                    "object_ref": "relationship--32b2bb93-7ddc-4f96-8bfd-2534309a9d75",
                    "object_modified": "2026-04-29T14:23:05.985Z"
                },
                {
                    "object_ref": "relationship--32bcf2cf-3311-4ef1-9bf4-4bfe14832b3b",
                    "object_modified": "2026-04-29T14:23:05.985Z"
                },
                {
                    "object_ref": "relationship--32d15d1a-04ba-4035-907a-e2871425e8d1",
                    "object_modified": "2026-04-29T14:23:05.986Z"
                },
                {
                    "object_ref": "relationship--330af428-95f6-4530-99ca-05bd00756b9f",
                    "object_modified": "2026-09-25T17:29:40.723Z"
                },
                {
                    "object_ref": "relationship--33215dfa-53d0-4bd7-a15d-cec9315c7c4d",
                    "object_modified": "2026-04-29T14:23:05.986Z"
                },
                {
                    "object_ref": "relationship--337f366d-3d76-470c-8ee2-0e2252648282",
                    "object_modified": "2026-04-29T14:23:05.986Z"
                },
                {
                    "object_ref": "relationship--33974565-1d55-445f-9f6f-983707000cf4",
                    "object_modified": "2026-04-29T14:23:05.987Z"
                },
                {
                    "object_ref": "relationship--33b1b49f-012d-4af3-835a-32d8c75b9e1b",
                    "object_modified": "2026-04-29T14:23:05.987Z"
                },
                {
                    "object_ref": "relationship--3412e6dd-6adb-4c91-a5d8-c4f68dd362d5",
                    "object_modified": "2026-04-29T14:23:05.989Z"
                },
                {
                    "object_ref": "relationship--34535779-9957-4766-a7fc-e8d4dbfb5eee",
                    "object_modified": "2026-04-29T14:23:05.989Z"
                },
                {
                    "object_ref": "relationship--345e698d-8302-4e84-9c5b-c3b78972c0e1",
                    "object_modified": "2026-04-29T14:23:05.989Z"
                },
                {
                    "object_ref": "relationship--3471632d-253d-469e-9e8c-3b291b4ae88a",
                    "object_modified": "2026-04-29T14:23:05.989Z"
                },
                {
                    "object_ref": "relationship--3478c49c-594b-4224-b7f9-2b0b09c67288",
                    "object_modified": "2026-04-29T14:23:05.989Z"
                },
                {
                    "object_ref": "relationship--3481b497-85b5-4733-8fc4-ae58de12aa29",
                    "object_modified": "2026-10-07T21:16:11.167Z"
                },
                {
                    "object_ref": "relationship--3484426b-33b6-4f9b-9b62-3dd114794848",
                    "object_modified": "2026-04-20T20:58:46.793Z"
                },
                {
                    "object_ref": "relationship--34ac1b1b-1103-4fc9-a62e-f1dd1451b28b",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--34cacc74-a461-4ed9-a683-952cbeea6e1d",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--34d4101b-b4c9-4ea3-a84d-81e84e7f5033",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--34dcc9e8-a43a-475b-81b6-b15240545075",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--350814da-5c36-42f9-8e58-8f9534e6ce0a",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--3522ad60-960f-4b77-ba34-64b0d32995ab",
                    "object_modified": "2026-09-25T20:32:41.531Z"
                },
                {
                    "object_ref": "relationship--3526acc8-8834-4aaa-87a5-51e587360cf5",
                    "object_modified": "2026-04-29T14:23:05.990Z"
                },
                {
                    "object_ref": "relationship--352ed52c-88ba-4731-a917-4c33da0f29d4",
                    "object_modified": "2026-08-04T20:48:44.778Z"
                },
                {
                    "object_ref": "relationship--355988ca-6eba-4f49-a08f-932f0fda998f",
                    "object_modified": "2026-10-07T21:56:20.813Z"
                },
                {
                    "object_ref": "relationship--35bacdf8-60e5-4590-a71c-43c53c94509a",
                    "object_modified": "2026-09-25T20:28:19.065Z"
                },
                {
                    "object_ref": "relationship--35cf6922-d48f-42ea-b7f5-f0258892bd52",
                    "object_modified": "2026-04-29T14:23:05.993Z"
                },
                {
                    "object_ref": "relationship--35d3a730-4de6-4406-a025-ad29340985c2",
                    "object_modified": "2026-04-29T14:23:05.993Z"
                },
                {
                    "object_ref": "relationship--3618a010-b94b-4974-b1be-7630d5c853c1",
                    "object_modified": "2026-07-31T20:48:35.322Z"
                },
                {
                    "object_ref": "relationship--3623e266-6de4-4165-b0fb-e9abf0813e5d",
                    "object_modified": "2026-04-29T14:23:05.993Z"
                },
                {
                    "object_ref": "relationship--3666c249-26c8-4aad-8dc7-5d07253b1c5c",
                    "object_modified": "2026-04-29T14:23:05.994Z"
                },
                {
                    "object_ref": "relationship--366a4cd1-aa95-4985-9d80-b45a2551e298",
                    "object_modified": "2026-04-29T14:23:05.994Z"
                },
                {
                    "object_ref": "relationship--3680ab7a-254b-426c-b417-460712c2f357",
                    "object_modified": "2026-04-29T14:23:05.994Z"
                },
                {
                    "object_ref": "relationship--368558ce-e8a6-4375-b54f-47c2ab31e38d",
                    "object_modified": "2026-04-29T14:23:05.994Z"
                },
                {
                    "object_ref": "relationship--37048032-b41d-47d8-9c73-7b706bef24d1",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--371fe079-430d-46dc-ad31-a53838fc6c24",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--372c2e72-d56a-4501-a3bc-31b6b0c8d0be",
                    "object_modified": "2026-09-03T20:31:39.237Z"
                },
                {
                    "object_ref": "relationship--3731962f-64e7-4750-ac8b-40b97eef8725",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--373627f1-5e68-45ab-b1ac-c063d9585a3e",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--374837a0-6109-4c95-bee6-893b25ac71cf",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--37754ab4-03de-475b-8eb2-4ac3fad63852",
                    "object_modified": "2026-04-29T14:23:05.995Z"
                },
                {
                    "object_ref": "relationship--37aeaf27-6bbe-4949-ba77-37649e38f8b2",
                    "object_modified": "2026-04-29T14:23:05.996Z"
                },
                {
                    "object_ref": "relationship--37b2e059-853e-423f-8504-a11b55f92160",
                    "object_modified": "2026-09-26T03:57:34.150Z"
                },
                {
                    "object_ref": "relationship--37e1b5d8-c800-4eee-9348-e183cc62d385",
                    "object_modified": "2026-04-29T14:23:05.996Z"
                },
                {
                    "object_ref": "relationship--37f0a727-5b6a-4acc-83fc-e2c13f5acc39",
                    "object_modified": "2026-04-29T14:23:05.996Z"
                },
                {
                    "object_ref": "relationship--380ef144-1443-4df1-b7de-a6ed3d66d573",
                    "object_modified": "2026-04-29T14:23:05.996Z"
                },
                {
                    "object_ref": "relationship--38165ec5-a989-4e77-bf30-31c892da23c1",
                    "object_modified": "2026-09-25T20:41:55.229Z"
                },
                {
                    "object_ref": "relationship--3838eb1c-488a-4e73-bc3d-e25cacd6926d",
                    "object_modified": "2026-04-20T20:58:37.797Z"
                },
                {
                    "object_ref": "relationship--383e242a-72d4-4b40-8905-888595c34919",
                    "object_modified": "2026-04-29T14:23:05.997Z"
                },
                {
                    "object_ref": "relationship--3843dcca-62a2-4224-9241-05f981fa880a",
                    "object_modified": "2026-04-29T14:23:05.997Z"
                },
                {
                    "object_ref": "relationship--387a9ace-17bd-484b-8d54-d3bbc1304c90",
                    "object_modified": "2026-07-31T20:48:19.571Z"
                },
                {
                    "object_ref": "relationship--388df1cd-3e92-4eee-ac0f-6d8b824cd42f",
                    "object_modified": "2026-09-26T05:09:20.561Z"
                },
                {
                    "object_ref": "relationship--38bda770-c470-4358-a9ad-a5b39bec026b",
                    "object_modified": "2026-04-29T14:23:05.997Z"
                },
                {
                    "object_ref": "relationship--393983b0-aeb0-4cc0-ae77-8180fe9f8f87",
                    "object_modified": "2026-04-29T14:23:05.998Z"
                },
                {
                    "object_ref": "relationship--39452123-574f-4f3a-95ec-a90170a3d7eb",
                    "object_modified": "2026-04-29T14:23:05.998Z"
                },
                {
                    "object_ref": "relationship--399126a9-815d-4c3b-9d5e-f57d698ac742",
                    "object_modified": "2026-04-29T14:23:05.999Z"
                },
                {
                    "object_ref": "relationship--39dcfc44-5f18-475f-b431-22032a14cbe5",
                    "object_modified": "2026-04-29T14:23:05.999Z"
                },
                {
                    "object_ref": "relationship--39e5a489-f557-4130-a285-e0a82f40685c",
                    "object_modified": "2026-04-29T14:23:05.999Z"
                },
                {
                    "object_ref": "relationship--39f785a8-4175-4d3c-ba64-e20ad4bc2584",
                    "object_modified": "2026-04-29T14:23:05.999Z"
                },
                {
                    "object_ref": "relationship--3a20ed21-5e69-4a16-a0e3-bace3eba9974",
                    "object_modified": "2026-04-29T14:23:06.000Z"
                },
                {
                    "object_ref": "relationship--3a6cd53d-0d4e-4cf8-8edf-f9ebde4faac4",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3a76a181-8706-4bc4-9c66-7e809fec44ca",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3a7d1db3-9383-4171-8938-382e9b0375c6",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3a9a07b5-0db5-40c6-b3e4-d1a006c85726",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--3a9fc435-30b7-4684-a874-026c129aaa79",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3aa2691d-d88d-4467-ae3e-242b3bac22ea",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3ab912a4-70aa-45f8-b2ef-57113dde2cfa",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3abaee7a-5d15-4364-9c74-775865a404b4",
                    "object_modified": "2026-04-29T14:23:06.001Z"
                },
                {
                    "object_ref": "relationship--3ad966be-8cb2-42e6-b696-ef9e3b512e35",
                    "object_modified": "2026-04-29T14:23:06.002Z"
                },
                {
                    "object_ref": "relationship--3afa12ce-4380-4e66-aa1d-4da20ac9023b",
                    "object_modified": "2026-04-29T14:23:06.002Z"
                },
                {
                    "object_ref": "relationship--3b6567a9-6213-4db4-a069-1a86b1098b63",
                    "object_modified": "2026-04-29T14:23:06.003Z"
                },
                {
                    "object_ref": "relationship--3b7f39cb-0101-49b0-ab02-a5adb1672688",
                    "object_modified": "2026-04-29T14:23:06.003Z"
                },
                {
                    "object_ref": "relationship--3b9a4916-78b9-44b3-b0fc-6f167a918d7d",
                    "object_modified": "2026-04-29T14:23:06.003Z"
                },
                {
                    "object_ref": "relationship--3bb10579-917d-4f59-ac6d-0bd731bffbdb",
                    "object_modified": "2026-10-07T20:28:53.866Z"
                },
                {
                    "object_ref": "relationship--3bc61c8f-3d04-40bd-8239-a15913056bb2",
                    "object_modified": "2026-04-29T14:23:06.004Z"
                },
                {
                    "object_ref": "relationship--3bd0868c-7124-4a84-9541-d6f95f746dd9",
                    "object_modified": "2026-10-09T17:27:10.928Z"
                },
                {
                    "object_ref": "relationship--3c2d1b8a-d092-4a71-a0d4-dc5abff338bc",
                    "object_modified": "2026-04-29T14:23:06.004Z"
                },
                {
                    "object_ref": "relationship--3c31f7d1-61c2-4fed-b4b6-601d8958e2f6",
                    "object_modified": "2026-10-07T21:56:54.021Z"
                },
                {
                    "object_ref": "relationship--3c790a63-5216-4418-9233-53c5921e0363",
                    "object_modified": "2026-10-07T20:30:46.344Z"
                },
                {
                    "object_ref": "relationship--3ce078ca-dad7-477a-8178-f0daf7ee823b",
                    "object_modified": "2026-04-29T14:23:06.008Z"
                },
                {
                    "object_ref": "relationship--3cf99739-b045-4a83-985d-e9984076b81d",
                    "object_modified": "2026-04-29T14:23:06.008Z"
                },
                {
                    "object_ref": "relationship--3d005ed8-77d3-4fed-9dd5-7e39ba8cb50a",
                    "object_modified": "2026-04-29T14:23:06.008Z"
                },
                {
                    "object_ref": "relationship--3d3c5d24-be5c-42e8-98ca-3b04382df39a",
                    "object_modified": "2026-04-29T14:23:06.008Z"
                },
                {
                    "object_ref": "relationship--3d676c1b-2650-4599-8a57-790c55f9977d",
                    "object_modified": "2026-04-29T14:23:06.009Z"
                },
                {
                    "object_ref": "relationship--3d991288-1770-4211-83dc-441ef9944e0f",
                    "object_modified": "2026-04-29T14:23:06.009Z"
                },
                {
                    "object_ref": "relationship--3dd15958-b159-4d01-b3c2-37bdf9b417b5",
                    "object_modified": "2026-04-29T14:23:06.009Z"
                },
                {
                    "object_ref": "relationship--3dd35c9a-146d-4370-80ac-69fed35d81a1",
                    "object_modified": "2026-04-29T14:23:06.009Z"
                },
                {
                    "object_ref": "relationship--3e0c8afc-4c4d-40cc-bb61-f76b3fc1b013",
                    "object_modified": "2026-04-29T14:23:06.009Z"
                },
                {
                    "object_ref": "relationship--3e1f42f9-2edf-4c32-ac1e-da726b923570",
                    "object_modified": "2026-04-29T14:23:06.010Z"
                },
                {
                    "object_ref": "relationship--3e249f0a-5755-4e0f-96ce-f3ce6376fed5",
                    "object_modified": "2026-04-29T14:23:06.010Z"
                },
                {
                    "object_ref": "relationship--3e9093f7-6212-4b34-b22e-4ecabc27c654",
                    "object_modified": "2026-04-29T14:23:06.010Z"
                },
                {
                    "object_ref": "relationship--3ea96b43-20d6-4a92-ae44-874a2dc17136",
                    "object_modified": "2026-09-25T20:29:01.731Z"
                },
                {
                    "object_ref": "relationship--3f07067f-0cbc-489c-8722-a33399ebd4f9",
                    "object_modified": "2026-04-29T14:23:06.011Z"
                },
                {
                    "object_ref": "relationship--3f106b71-2d71-4910-a909-24191ab6349f",
                    "object_modified": "2026-10-07T20:19:14.515Z"
                },
                {
                    "object_ref": "relationship--3f261739-b6ec-4a86-94a3-146929f9facf",
                    "object_modified": "2026-07-31T20:48:13.528Z"
                },
                {
                    "object_ref": "relationship--3f335e8f-68da-4b06-9d96-f371ddaf23e6",
                    "object_modified": "2026-04-29T14:23:06.011Z"
                },
                {
                    "object_ref": "relationship--3f76d408-be8a-478e-8a5a-aab1d1f96572",
                    "object_modified": "2026-04-29T14:23:06.011Z"
                },
                {
                    "object_ref": "relationship--3f9093f6-fb01-45e0-924f-a71a536336b2",
                    "object_modified": "2026-04-29T14:23:06.011Z"
                },
                {
                    "object_ref": "relationship--3f92c11b-f6e2-4c07-9913-9fa7469ba4fe",
                    "object_modified": "2026-04-29T14:23:06.011Z"
                },
                {
                    "object_ref": "relationship--3f9d6d25-6824-48b9-a7d3-6d4729250a33",
                    "object_modified": "2026-10-07T20:19:27.440Z"
                },
                {
                    "object_ref": "relationship--3f9f3845-33a9-488a-afd7-8db1bb53fe88",
                    "object_modified": "2026-04-29T14:23:06.012Z"
                },
                {
                    "object_ref": "relationship--3fe69c6d-6722-44ad-bab7-e34981d68daa",
                    "object_modified": "2026-04-29T14:23:06.012Z"
                },
                {
                    "object_ref": "relationship--4011b9e8-317f-40b9-bd3c-3fb1e99c6542",
                    "object_modified": "2026-04-29T14:23:06.012Z"
                },
                {
                    "object_ref": "relationship--40477010-e2db-4e4d-8896-6e401a89ac03",
                    "object_modified": "2026-04-29T14:23:06.013Z"
                },
                {
                    "object_ref": "relationship--40479f3e-d4d2-45f8-893f-f8a4fcf1613c",
                    "object_modified": "2026-09-03T20:28:48.912Z"
                },
                {
                    "object_ref": "relationship--4059da6f-b52b-4265-8bf9-3ad6154dbde4",
                    "object_modified": "2026-04-29T14:23:06.013Z"
                },
                {
                    "object_ref": "relationship--4071dca7-2405-4856-8130-44cc1aadded2",
                    "object_modified": "2026-04-29T14:23:06.013Z"
                },
                {
                    "object_ref": "relationship--408b2389-3280-46c6-8c94-2579b47b2340",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--40fdaedd-04b4-42ad-8bea-a0513de65f73",
                    "object_modified": "2026-07-31T20:48:19.595Z"
                },
                {
                    "object_ref": "relationship--413c1c41-6ef9-413b-a75a-e67f1668b3db",
                    "object_modified": "2026-09-03T20:30:36.510Z"
                },
                {
                    "object_ref": "relationship--413d5a01-4e80-4d8a-a9ad-9d90792b852a",
                    "object_modified": "2026-04-29T14:23:06.014Z"
                },
                {
                    "object_ref": "relationship--415b3d09-f30e-4f25-8cae-bbe7fef80275",
                    "object_modified": "2026-04-29T14:23:06.014Z"
                },
                {
                    "object_ref": "relationship--41856149-91d5-4815-b50f-8eb371ac5ba6",
                    "object_modified": "2026-07-31T20:48:16.183Z"
                },
                {
                    "object_ref": "relationship--419a1f4b-b36e-44ec-8a91-d4138c5fb353",
                    "object_modified": "2026-10-07T17:52:25.669Z"
                },
                {
                    "object_ref": "relationship--41a109dd-11d9-4840-a38b-088fc790f45a",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--41abc220-4ec6-41cc-bb36-37c43341fc41",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--41adaf0b-b7ae-4bdb-9a5b-567fd0911d7a",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--41dbf626-b968-4b51-9f7d-aaea14d39b4d",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--4211c12a-57cf-4ebb-910a-6af7aa09cf34",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--423271c0-04dc-42d0-8e27-fb0b6067e096",
                    "object_modified": "2026-08-04T20:48:44.794Z"
                },
                {
                    "object_ref": "relationship--4256a0c2-437d-4a4c-88ac-d08d3041b8c1",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--42577e40-8a29-461b-aeb6-232f4b04d76a",
                    "object_modified": "2026-04-29T14:23:06.015Z"
                },
                {
                    "object_ref": "relationship--42ab7d24-8286-4a7a-8cd7-02e54a80e13f",
                    "object_modified": "2026-04-29T14:23:06.016Z"
                },
                {
                    "object_ref": "relationship--4302566f-0eee-43a2-b40d-658e7cc0a57b",
                    "object_modified": "2026-04-29T14:23:06.016Z"
                },
                {
                    "object_ref": "relationship--432b2dc0-52ff-488f-a5e9-c1e510fc7a0b",
                    "object_modified": "2026-04-29T14:23:06.017Z"
                },
                {
                    "object_ref": "relationship--43344cd7-5004-4dac-8b62-8899105fa265",
                    "object_modified": "2026-04-29T14:23:06.017Z"
                },
                {
                    "object_ref": "relationship--433539bf-cb17-4de1-9c0f-e579b041514f",
                    "object_modified": "2026-09-03T20:28:48.924Z"
                },
                {
                    "object_ref": "relationship--4369da69-bb09-4cc8-8600-081a450f50e0",
                    "object_modified": "2026-04-29T14:23:06.017Z"
                },
                {
                    "object_ref": "relationship--4387dbb0-8602-4485-ab55-2ed63d8b1622",
                    "object_modified": "2026-04-29T14:23:06.017Z"
                },
                {
                    "object_ref": "relationship--43ab749c-d449-4fca-a14b-0f3a991fcdcc",
                    "object_modified": "2026-04-29T14:23:06.017Z"
                },
                {
                    "object_ref": "relationship--43aecac8-9920-4cbf-bdd0-6a204cb64942",
                    "object_modified": "2026-04-29T14:23:06.018Z"
                },
                {
                    "object_ref": "relationship--43d9821c-13ba-4009-b58b-a073918b780f",
                    "object_modified": "2026-04-29T14:23:06.018Z"
                },
                {
                    "object_ref": "relationship--43e7ed35-4038-4bc3-82bb-d5ff337b368a",
                    "object_modified": "2026-04-29T14:23:06.018Z"
                },
                {
                    "object_ref": "relationship--446c95ea-5178-4ae9-8f92-cb20dd50f7de",
                    "object_modified": "2026-04-29T14:23:06.019Z"
                },
                {
                    "object_ref": "relationship--44c857cf-7a4e-405a-87ca-7f6d79000589",
                    "object_modified": "2026-04-29T14:23:06.019Z"
                },
                {
                    "object_ref": "relationship--44dd2e01-9aca-44c4-bfb8-05d16c928793",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--44e0627e-d100-4e11-adab-4ff093e6031e",
                    "object_modified": "2026-04-29T14:23:06.019Z"
                },
                {
                    "object_ref": "relationship--4560f607-106b-4546-8f58-bd45c2a5c5f8",
                    "object_modified": "2026-04-29T14:23:06.020Z"
                },
                {
                    "object_ref": "relationship--456ff399-4925-45d4-aa84-d930eae5348e",
                    "object_modified": "2026-04-29T14:23:06.020Z"
                },
                {
                    "object_ref": "relationship--45aae58e-1d09-49de-b4c2-837c6f1d5d8f",
                    "object_modified": "2026-09-03T20:31:39.248Z"
                },
                {
                    "object_ref": "relationship--45d14170-7f7b-4e08-b53f-42fa4a3a04d9",
                    "object_modified": "2026-04-29T14:23:06.021Z"
                },
                {
                    "object_ref": "relationship--45ee1822-71e4-4d92-976d-306561b70555",
                    "object_modified": "2026-04-29T14:23:06.021Z"
                },
                {
                    "object_ref": "relationship--461e81a2-c7ad-499e-908d-05ef2f7bd9cd",
                    "object_modified": "2026-04-29T14:23:06.021Z"
                },
                {
                    "object_ref": "relationship--4653847b-c089-4435-9159-6f76353833f7",
                    "object_modified": "2026-04-29T14:23:06.021Z"
                },
                {
                    "object_ref": "relationship--46690df4-ddac-4ed4-8987-8706ae68a0cf",
                    "object_modified": "2026-04-29T14:23:06.021Z"
                },
                {
                    "object_ref": "relationship--46798892-d849-43fe-8147-b40cc9da291e",
                    "object_modified": "2026-09-03T20:31:39.261Z"
                },
                {
                    "object_ref": "relationship--46bc86e4-e20b-4778-80d2-8891039e6fb4",
                    "object_modified": "2026-04-29T14:23:06.022Z"
                },
                {
                    "object_ref": "relationship--46e4cdd2-e8f0-46aa-9264-868815a05af9",
                    "object_modified": "2026-04-29T14:23:06.022Z"
                },
                {
                    "object_ref": "relationship--4768c731-3be9-44b8-a217-dfbececa57d9",
                    "object_modified": "2026-04-29T14:23:06.023Z"
                },
                {
                    "object_ref": "relationship--476fdcf2-0b39-4ddc-9744-ef54d3b9efb8",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--47b1bc70-9fe4-4a6f-a137-f51db24566da",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--47f15a06-8675-4698-833d-bd141ed9e755",
                    "object_modified": "2026-04-29T14:23:06.023Z"
                },
                {
                    "object_ref": "relationship--484b0873-59ef-41a3-b33d-b3fb41a2c957",
                    "object_modified": "2026-04-29T14:23:06.024Z"
                },
                {
                    "object_ref": "relationship--485499a0-221b-4f32-bcf5-99697775e0cd",
                    "object_modified": "2026-10-07T21:14:27.387Z"
                },
                {
                    "object_ref": "relationship--48874e6b-1b97-4c3b-af85-7bfaceff4a4a",
                    "object_modified": "2026-10-07T20:19:59.748Z"
                },
                {
                    "object_ref": "relationship--48e142d5-ebfe-4950-8704-409c6b92f693",
                    "object_modified": "2026-04-20T20:54:22.411Z"
                },
                {
                    "object_ref": "relationship--490c0435-b918-4843-bee1-0584f8092ce4",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--491455dc-f7c8-4e12-811b-b8c5c041b4c3",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--49242ea8-4813-49f7-8bd4-9668216cceeb",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--4966e63c-ca05-466d-91f9-41d799a54471",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--497e0dbf-b36e-4c2e-9368-67553c8ba5b1",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--4981a944-b3ad-4d78-9881-a17d458e3422",
                    "object_modified": "2026-04-29T14:23:06.025Z"
                },
                {
                    "object_ref": "relationship--49966e16-04a2-4fd7-86cd-aa934040a9d8",
                    "object_modified": "2026-09-03T20:31:39.272Z"
                },
                {
                    "object_ref": "relationship--49aebf0c-e231-4cbb-84a2-97c9a6d11654",
                    "object_modified": "2026-04-29T14:23:06.026Z"
                },
                {
                    "object_ref": "relationship--49d38b21-5ce5-48d9-a356-639fc6c7a53d",
                    "object_modified": "2026-04-29T14:23:06.026Z"
                },
                {
                    "object_ref": "relationship--4a641966-3cc8-4dd6-aa61-1a96cfff4a05",
                    "object_modified": "2026-04-29T14:23:06.027Z"
                },
                {
                    "object_ref": "relationship--4a7340fc-0eec-4459-a491-952d736b79ef",
                    "object_modified": "2026-09-03T20:30:36.523Z"
                },
                {
                    "object_ref": "relationship--4ad65338-18dd-4ccf-96d9-a15c0af8e2e2",
                    "object_modified": "2026-09-26T05:30:11.136Z"
                },
                {
                    "object_ref": "relationship--4b353f8e-15ff-4fab-9f09-270ffb744a0f",
                    "object_modified": "2026-04-29T14:23:06.028Z"
                },
                {
                    "object_ref": "relationship--4b44a657-11cc-45bc-b096-f32e58a70036",
                    "object_modified": "2026-04-29T14:23:06.028Z"
                },
                {
                    "object_ref": "relationship--4b6a964f-af5c-4ec2-a309-c1ae6b929596",
                    "object_modified": "2026-04-29T14:23:06.028Z"
                },
                {
                    "object_ref": "relationship--4b853b7c-bc55-4599-b88d-d08d651526c0",
                    "object_modified": "2026-04-29T14:23:06.028Z"
                },
                {
                    "object_ref": "relationship--4b98b72c-a093-4917-a21b-a0b4f388e98e",
                    "object_modified": "2026-07-31T21:05:25.681Z"
                },
                {
                    "object_ref": "relationship--4bcbf856-1a3f-4dcf-8e00-5e925025ffc4",
                    "object_modified": "2026-04-29T14:23:06.029Z"
                },
                {
                    "object_ref": "relationship--4be1cc93-c5f8-4501-a10b-489463101169",
                    "object_modified": "2026-10-07T19:46:29.393Z"
                },
                {
                    "object_ref": "relationship--4c10bd09-f51b-4190-811d-8ee3c6fb7696",
                    "object_modified": "2026-10-07T17:52:00.452Z"
                },
                {
                    "object_ref": "relationship--4c1df272-9c2a-4647-8d05-3c0de1613e12",
                    "object_modified": "2026-04-29T14:23:06.029Z"
                },
                {
                    "object_ref": "relationship--4c4fe037-c9ae-4f38-b717-901d3ce09528",
                    "object_modified": "2026-10-08T01:22:21.388Z"
                },
                {
                    "object_ref": "relationship--4c53b294-973f-4cc2-a781-6c86b8f1c962",
                    "object_modified": "2026-04-29T14:23:06.029Z"
                },
                {
                    "object_ref": "relationship--4c5f0aeb-d4ae-4f37-9fec-ba4d844a0c21",
                    "object_modified": "2026-07-31T20:48:57.262Z"
                },
                {
                    "object_ref": "relationship--4c6b7176-650b-448d-9d5b-28eb36bcafae",
                    "object_modified": "2026-04-29T14:23:06.029Z"
                },
                {
                    "object_ref": "relationship--4cb8291c-f9eb-4c84-bb15-695685fd7064",
                    "object_modified": "2026-04-29T14:23:06.030Z"
                },
                {
                    "object_ref": "relationship--4cc2bf97-b439-40a9-8e18-cc9daca1bab6",
                    "object_modified": "2026-04-29T14:23:06.030Z"
                },
                {
                    "object_ref": "relationship--4cec834f-831f-46e6-9cd2-a6fdfa45d06b",
                    "object_modified": "2026-04-29T14:23:06.030Z"
                },
                {
                    "object_ref": "relationship--4d163eab-7118-49c3-a4e9-d4f26d09b314",
                    "object_modified": "2026-04-29T14:23:06.030Z"
                },
                {
                    "object_ref": "relationship--4d407dda-944a-4974-b1c2-0a04d2c9ee4c",
                    "object_modified": "2026-08-04T20:48:44.810Z"
                },
                {
                    "object_ref": "relationship--4d501413-0a23-4f44-97b8-38ddbc38c04a",
                    "object_modified": "2026-09-25T20:34:17.394Z"
                },
                {
                    "object_ref": "relationship--4d76274d-75bc-4cd0-be6a-3d5d99f73cb7",
                    "object_modified": "2026-04-29T14:23:06.031Z"
                },
                {
                    "object_ref": "relationship--4dd93fd2-6e6d-4c50-a091-6d6ea6903f1e",
                    "object_modified": "2026-04-29T14:23:06.031Z"
                },
                {
                    "object_ref": "relationship--4e1e6e4b-c38b-477e-8026-f12a58558484",
                    "object_modified": "2026-04-20T20:58:39.169Z"
                },
                {
                    "object_ref": "relationship--4e7ec200-9a1b-46d4-9383-738903fec554",
                    "object_modified": "2026-04-29T14:23:06.032Z"
                },
                {
                    "object_ref": "relationship--4ef202e5-b1cb-4cc4-892d-df6bf683c596",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--4f086dee-d4ed-41fb-a4f7-e6b7875a98eb",
                    "object_modified": "2026-10-07T20:38:02.187Z"
                },
                {
                    "object_ref": "relationship--4f3a843b-18e7-46e8-8285-9102a2fe62e5",
                    "object_modified": "2026-04-29T14:23:06.033Z"
                },
                {
                    "object_ref": "relationship--4f7cc4b9-fe3a-4883-97cc-4d2a44c55be9",
                    "object_modified": "2026-04-29T14:23:06.033Z"
                },
                {
                    "object_ref": "relationship--4f83cc15-274d-44c6-859f-e598e362e76e",
                    "object_modified": "2026-08-04T20:48:44.837Z"
                },
                {
                    "object_ref": "relationship--4fde32fb-56b6-458b-92ac-55f81bc91783",
                    "object_modified": "2026-04-20T20:54:26.012Z"
                },
                {
                    "object_ref": "relationship--4fde6641-ad83-4b23-b51c-97fe7bdc558c",
                    "object_modified": "2026-04-29T14:23:06.034Z"
                },
                {
                    "object_ref": "relationship--502a0b7e-048a-468a-b888-e91fde47c6eb",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--50324c5f-50e9-4d81-a8ba-a076827259a0",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--503c5256-b611-437e-a4ef-2ee1fd20ab29",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--5041e17d-6349-4589-8c61-7b43964b5f9b",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--504f74ff-ce0c-4e2d-840a-79c17ba2cbce",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--5068c7c3-5922-447a-bf49-8301e797e992",
                    "object_modified": "2026-08-04T20:48:44.849Z"
                },
                {
                    "object_ref": "relationship--508cf980-e2da-4a34-a069-23201ad336e5",
                    "object_modified": "2026-10-07T21:54:06.902Z"
                },
                {
                    "object_ref": "relationship--50a10bc7-950b-4a12-aeaf-52a7b013efc2",
                    "object_modified": "2026-10-09T00:01:31.082Z"
                },
                {
                    "object_ref": "relationship--50a2b289-7bce-405d-8515-c2b5424cce5c",
                    "object_modified": "2026-04-29T14:23:06.035Z"
                },
                {
                    "object_ref": "relationship--50b3247a-ea71-455e-b299-f00666c05146",
                    "object_modified": "2026-04-29T14:23:06.036Z"
                },
                {
                    "object_ref": "relationship--50c20664-75dc-451e-b026-67b1d309e4b5",
                    "object_modified": "2026-04-29T14:23:06.036Z"
                },
                {
                    "object_ref": "relationship--50c2224e-7592-4400-afbb-6434e025bfd8",
                    "object_modified": "2026-04-29T14:23:06.036Z"
                },
                {
                    "object_ref": "relationship--5131c799-517c-4bad-ba97-46ad7de956e7",
                    "object_modified": "2026-04-29T14:23:06.036Z"
                },
                {
                    "object_ref": "relationship--513e6965-7ce0-47de-b2a0-8f0ba4978ce4",
                    "object_modified": "2026-04-29T14:23:06.036Z"
                },
                {
                    "object_ref": "relationship--5152ea91-af3f-4317-81ca-b3cf910b471a",
                    "object_modified": "2026-09-03T20:30:36.535Z"
                },
                {
                    "object_ref": "relationship--51957f0f-79e2-4716-beec-0fec67e4482f",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--51eb15a3-48af-470f-94c0-10f25b366d72",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--51f9963c-c041-4bec-b482-5fda2fb5bca4",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--5201c576-70a5-4b32-8dfd-dd8ac86f096c",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--520aad6a-2483-45bc-a172-2417137f6ca0",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--5212f36b-216f-4e32-8b64-3b4c94dfada5",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--523777f8-4780-4716-807c-08a67450b916",
                    "object_modified": "2026-04-29T14:23:06.037Z"
                },
                {
                    "object_ref": "relationship--524ffb0f-40ae-4c97-a098-d14001fffa31",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--525d0a51-bbf9-4cda-aec9-562bb05bd3a0",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--527676d2-9dd0-40c6-8fc5-10209a82c986",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--52855d5d-e835-470f-a675-751c2779c861",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--529610e5-831f-48df-a22f-fa088b9f9e9e",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--52a592dd-61c0-4884-a680-0d6f9112077e",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--52bfd00c-2e5b-4e43-bba6-f3b46e241d7b",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--52c7176b-431d-44a6-8c03-7c15a8cf6ce1",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--52c85466-d3d2-46f5-9597-5fae78de9c51",
                    "object_modified": "2026-10-07T21:54:51.635Z"
                },
                {
                    "object_ref": "relationship--52e828db-58d0-443e-8d94-54d265d9606e",
                    "object_modified": "2026-04-29T14:23:06.038Z"
                },
                {
                    "object_ref": "relationship--5338abbc-11f7-44e4-b97e-5439c1c1b45b",
                    "object_modified": "2026-04-29T14:23:06.039Z"
                },
                {
                    "object_ref": "relationship--533bd747-2567-4c53-a10b-938734f8aeab",
                    "object_modified": "2026-07-31T20:48:14.158Z"
                },
                {
                    "object_ref": "relationship--5343d50a-a36a-4470-9390-98ecd19b800b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--535c5160-17e0-44eb-9f4b-1a8e216b56a2",
                    "object_modified": "2026-04-29T14:23:06.039Z"
                },
                {
                    "object_ref": "relationship--53754728-a86b-4db2-b4de-197bd491167f",
                    "object_modified": "2026-07-31T20:48:58.468Z"
                },
                {
                    "object_ref": "relationship--538e5653-137a-4ce2-8b08-5ba69caa794a",
                    "object_modified": "2026-07-31T20:48:42.170Z"
                },
                {
                    "object_ref": "relationship--53a54e4a-2b38-4b0c-8f60-252a68767443",
                    "object_modified": "2026-04-29T14:23:06.039Z"
                },
                {
                    "object_ref": "relationship--53af6987-21bb-46fd-bf85-e3eeaa74de1a",
                    "object_modified": "2026-04-29T14:23:06.039Z"
                },
                {
                    "object_ref": "relationship--53d7a78d-1431-49e8-944c-62c875e58a20",
                    "object_modified": "2026-04-29T14:23:06.040Z"
                },
                {
                    "object_ref": "relationship--5424e327-396f-4b07-94a3-408ffc915686",
                    "object_modified": "2026-07-31T20:48:27.996Z"
                },
                {
                    "object_ref": "relationship--5425d1cd-8840-4640-90a3-72f3bd7151bd",
                    "object_modified": "2026-04-29T14:23:06.040Z"
                },
                {
                    "object_ref": "relationship--544e996c-0bdc-42b2-91af-14c27d4213b9",
                    "object_modified": "2026-04-29T14:23:06.040Z"
                },
                {
                    "object_ref": "relationship--544f0447-0f37-4b1c-b424-3fbcdee15e63",
                    "object_modified": "2026-04-29T14:23:06.040Z"
                },
                {
                    "object_ref": "relationship--54a7bc3f-c05f-4fb3-a980-ffc8750a0a56",
                    "object_modified": "2026-04-29T14:23:06.041Z"
                },
                {
                    "object_ref": "relationship--54a977df-ca85-43b2-b2bc-96fdcd23aa9b",
                    "object_modified": "2026-04-29T14:23:06.041Z"
                },
                {
                    "object_ref": "relationship--5526e92e-070b-402e-b149-a06bff5a4549",
                    "object_modified": "2026-09-26T05:13:25.808Z"
                },
                {
                    "object_ref": "relationship--5542d884-ac75-4e1f-9d60-29add89c8567",
                    "object_modified": "2026-04-29T14:23:06.042Z"
                },
                {
                    "object_ref": "relationship--55adf560-78f2-4804-a135-ec49bb70c6a4",
                    "object_modified": "2026-04-29T14:23:06.042Z"
                },
                {
                    "object_ref": "relationship--56636da0-ea2b-4c51-87d2-f7fcff26ea1a",
                    "object_modified": "2026-04-29T14:23:06.043Z"
                },
                {
                    "object_ref": "relationship--56672ea4-cbf0-4a3e-8aed-edcc7d33133b",
                    "object_modified": "2026-04-29T14:23:06.043Z"
                },
                {
                    "object_ref": "relationship--56896f6b-27fe-4396-bfea-d3c1a7580b18",
                    "object_modified": "2026-04-29T14:23:06.043Z"
                },
                {
                    "object_ref": "relationship--56a561d2-5230-4456-99b5-989dbeac715c",
                    "object_modified": "2026-04-29T14:23:06.043Z"
                },
                {
                    "object_ref": "relationship--56dcc2d7-5243-4a5d-a556-8723642e98a4",
                    "object_modified": "2026-04-29T14:23:06.044Z"
                },
                {
                    "object_ref": "relationship--56f22365-3711-468a-8f57-ee4193bf1ee8",
                    "object_modified": "2026-04-29T14:23:06.044Z"
                },
                {
                    "object_ref": "relationship--575f0e0b-d68d-432b-abb3-cbd3e641fc88",
                    "object_modified": "2026-04-29T14:23:06.044Z"
                },
                {
                    "object_ref": "relationship--577b53a0-44ff-4cc4-b571-455d61e596c0",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--578117b2-0f4b-4d75-a2dc-3ee45976e616",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--57abea59-09c3-496f-a6b9-21c6a0cb9b7a",
                    "object_modified": "2026-07-31T20:48:19.633Z"
                },
                {
                    "object_ref": "relationship--57e8711a-9aae-4a22-94d4-f4c8a3a8f141",
                    "object_modified": "2026-07-31T21:05:25.729Z"
                },
                {
                    "object_ref": "relationship--57ff803c-0380-4176-bb42-f7bb30e79fec",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--5804ae3d-0daf-47a5-b026-d42878f55803",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--5812613d-e4ef-4201-a717-c7f239daeaf3",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--58269882-7e8d-4d24-b7a3-dbef6196cb61",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--582aca6c-d421-4c84-89fc-f52e87cc306a",
                    "object_modified": "2026-04-29T14:23:06.045Z"
                },
                {
                    "object_ref": "relationship--58978012-8185-4a15-9bbc-6bdb33c91039",
                    "object_modified": "2026-04-20T20:54:16.595Z"
                },
                {
                    "object_ref": "relationship--58a0fd57-ea5f-46b0-84ac-c5b963fb7e94",
                    "object_modified": "2026-04-29T14:23:06.046Z"
                },
                {
                    "object_ref": "relationship--58cb4cb5-4b0f-4ce0-b3f9-5deb9de31c52",
                    "object_modified": "2026-04-29T14:23:06.046Z"
                },
                {
                    "object_ref": "relationship--58edd7e0-7b54-4ac5-8e84-81e2dfb03a71",
                    "object_modified": "2026-04-29T14:23:06.046Z"
                },
                {
                    "object_ref": "relationship--58f5c89c-7ed2-4e14-ac07-6e95da16e2f1",
                    "object_modified": "2026-04-29T14:23:06.046Z"
                },
                {
                    "object_ref": "relationship--58f6af27-8f72-4630-a0d8-27753bc6a5df",
                    "object_modified": "2026-09-26T03:37:00.078Z"
                },
                {
                    "object_ref": "relationship--58fdcdd1-d3e2-43b4-80a8-8f9ba7f967c2",
                    "object_modified": "2026-07-31T20:48:19.663Z"
                },
                {
                    "object_ref": "relationship--5914a482-dbb7-429d-96f3-77f0588ac12d",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--591620d3-5549-49db-9080-43f86a68a590",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--5916d742-2fcf-4421-b3c1-e4370cabfa13",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--5924f411-11f0-4ac9-94b5-0f8dec844999",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--592e202e-de91-48df-bbcc-09c9df1851f8",
                    "object_modified": "2026-10-07T20:29:56.186Z"
                },
                {
                    "object_ref": "relationship--59685dcb-3076-4171-b43f-0ddca6555dc0",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--5968cbde-b3da-46df-a8bd-a30c2d85363b",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--598386c1-778c-41b7-af1e-e0947651f4ca",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--59a2d15c-f4a4-4df8-ab33-2966db4e2500",
                    "object_modified": "2026-09-26T03:01:51.374Z"
                },
                {
                    "object_ref": "relationship--59b53303-e4df-49ec-8e5a-812f2b4265a8",
                    "object_modified": "2026-04-29T14:23:06.047Z"
                },
                {
                    "object_ref": "relationship--59cb471f-ad8b-464f-ab8f-c267f329b0dc",
                    "object_modified": "2026-07-31T20:48:16.191Z"
                },
                {
                    "object_ref": "relationship--5a43a422-4235-44b8-87e4-bc82e83d44f3",
                    "object_modified": "2026-09-03T20:28:48.936Z"
                },
                {
                    "object_ref": "relationship--5a96d5e3-4c95-4312-a43a-b986d9bb5781",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5a97008b-c23b-4890-ba76-c30cf2a18fba",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5adfe50f-938b-4d8e-885d-0c0ebf43bdcd",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5ae1cf3a-2603-4bf9-ace3-5b1ee5d8d757",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5ae382ac-27c6-480a-9269-241751553c52",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5b060600-e8b8-4dd8-8ed7-aadbccb8e2a8",
                    "object_modified": "2026-04-29T14:23:06.049Z"
                },
                {
                    "object_ref": "relationship--5b701c8d-374a-4a6b-a695-b5c7a747ceb2",
                    "object_modified": "2026-04-29T14:23:06.050Z"
                },
                {
                    "object_ref": "relationship--5bad41f1-7a3f-42c6-9b9d-6975212697e2",
                    "object_modified": "2026-04-29T14:23:06.050Z"
                },
                {
                    "object_ref": "relationship--5bb313a8-8407-4ec1-a4b0-683ded7f3302",
                    "object_modified": "2026-04-29T14:23:06.050Z"
                },
                {
                    "object_ref": "relationship--5bd2b468-10de-4346-80f0-f46f25707069",
                    "object_modified": "2026-04-29T14:23:06.050Z"
                },
                {
                    "object_ref": "relationship--5be1f2b1-75fd-4e7e-901b-495cee4ab5ad",
                    "object_modified": "2026-09-03T20:31:27.520Z"
                },
                {
                    "object_ref": "relationship--5beda54d-cd1f-491b-a85e-d7618a0683ad",
                    "object_modified": "2026-07-31T20:48:14.178Z"
                },
                {
                    "object_ref": "relationship--5bf085ed-b116-4e78-ad79-d5b04fe8b064",
                    "object_modified": "2026-10-07T21:53:35.470Z"
                },
                {
                    "object_ref": "relationship--5bf8473c-3c60-4a8a-8514-c2b50ab8a92d",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5bfb710a-02bb-4c4a-8f4a-8a7fe66c453f",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5c47a389-30fb-4d42-935d-282c29b67feb",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5c4add91-8956-4d66-a5e9-d17e7ee92cfb",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5c61c8a2-bfff-43fb-8397-bff864413d74",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5c8c8976-2cac-4185-9719-ef55c1032d6a",
                    "object_modified": "2026-04-29T14:23:06.051Z"
                },
                {
                    "object_ref": "relationship--5ca1d677-b41f-4f1e-b86b-f5637a418829",
                    "object_modified": "2026-04-29T14:23:06.052Z"
                },
                {
                    "object_ref": "relationship--5d0a7979-0420-4fd1-b5ad-cb5565cbdf9d",
                    "object_modified": "2026-04-29T14:23:06.052Z"
                },
                {
                    "object_ref": "relationship--5d33de22-35b0-47fa-bc63-f984522340b7",
                    "object_modified": "2026-04-29T14:23:06.052Z"
                },
                {
                    "object_ref": "relationship--5d4f6aff-650c-45fe-a9d8-2080d3ea02d7",
                    "object_modified": "2026-04-29T14:23:06.052Z"
                },
                {
                    "object_ref": "relationship--5d788a27-a1ba-4f22-aa03-b43875d6ace1",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5d9d7c5d-c455-4bcc-9d2c-80f6746632b9",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5db3a67e-8a3a-479e-a723-fe0f0c9e3563",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5dcf5ba3-bfa8-4aa4-be5f-e5aea64b3591",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5de6bf53-0a02-439b-a8d0-248fa9640a36",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5dfa5bad-8b0b-4884-bf01-04ea89e3ccf7",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5e099568-fb5c-4f58-af7e-4e1b7a9d1128",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5e324da5-0fee-4dac-b289-410d560e03e9",
                    "object_modified": "2026-04-29T14:23:06.053Z"
                },
                {
                    "object_ref": "relationship--5e951a86-1d12-4b14-be4b-7eb4d8fe3a38",
                    "object_modified": "2026-10-07T21:15:01.788Z"
                },
                {
                    "object_ref": "relationship--5ebb309c-98a9-415a-8c22-2308f69a19b0",
                    "object_modified": "2026-04-29T14:23:06.054Z"
                },
                {
                    "object_ref": "relationship--5ee01089-2ab6-4cf5-a39d-adf72666eceb",
                    "object_modified": "2026-09-03T20:30:36.549Z"
                },
                {
                    "object_ref": "relationship--5f03ee5d-534c-454c-aae3-b41130b00286",
                    "object_modified": "2026-04-29T14:23:06.054Z"
                },
                {
                    "object_ref": "relationship--5f4badb1-5583-4101-84e4-5b6ebdb0c463",
                    "object_modified": "2026-04-29T14:23:06.055Z"
                },
                {
                    "object_ref": "relationship--5f57e37e-fa3e-4cb6-973e-7e69f61a65c2",
                    "object_modified": "2026-04-29T14:23:06.055Z"
                },
                {
                    "object_ref": "relationship--5f5c38f6-aa3e-4447-a2d3-a76830ab36b0",
                    "object_modified": "2026-04-29T14:23:06.055Z"
                },
                {
                    "object_ref": "relationship--5fd9eaf1-7517-4110-9df1-1e0374a924a9",
                    "object_modified": "2026-04-29T14:23:06.055Z"
                },
                {
                    "object_ref": "relationship--604a9bf0-81a3-425b-9005-779c4f0f749d",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--604e1830-11ac-4ccf-a1d0-b22b80c1b024",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--605dcc44-9e1c-42a9-bc0f-5dfa81444022",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--605f3853-b007-4134-8a2d-6a81a35e7676",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--6067c069-8e93-4bf0-bb49-97538d55c3de",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--6079656e-d391-4de7-aeff-20c0f00f68c3",
                    "object_modified": "2026-04-29T14:23:06.056Z"
                },
                {
                    "object_ref": "relationship--60e80053-046c-4f53-b1cb-8778cbda8937",
                    "object_modified": "2026-04-29T14:23:06.057Z"
                },
                {
                    "object_ref": "relationship--60fde424-5a48-4603-9c64-f335a2c6be5a",
                    "object_modified": "2026-10-07T21:15:45.543Z"
                },
                {
                    "object_ref": "relationship--610af67a-5e9a-4f10-a88f-d74451e0bac1",
                    "object_modified": "2026-04-29T14:23:06.057Z"
                },
                {
                    "object_ref": "relationship--6124eea3-34b1-4829-89b7-d837910515e6",
                    "object_modified": "2026-04-29T14:23:06.057Z"
                },
                {
                    "object_ref": "relationship--61668e93-6d9d-418d-9fbd-2d88c3a66544",
                    "object_modified": "2026-04-29T14:23:06.057Z"
                },
                {
                    "object_ref": "relationship--61869a8e-d6da-478a-b770-47f97beae8b4",
                    "object_modified": "2026-07-31T20:48:32.948Z"
                },
                {
                    "object_ref": "relationship--619b3740-df20-4974-858f-f8067749d7b0",
                    "object_modified": "2026-04-29T14:23:06.058Z"
                },
                {
                    "object_ref": "relationship--6258c355-677c-452d-b1fc-27767232437b",
                    "object_modified": "2026-09-03T20:31:39.284Z"
                },
                {
                    "object_ref": "relationship--626eb4df-e9b4-49b8-b59f-35ee63b2d2d9",
                    "object_modified": "2026-10-07T21:41:27.737Z"
                },
                {
                    "object_ref": "relationship--62abe387-10a2-414b-881c-060b70db2157",
                    "object_modified": "2026-04-29T14:23:06.059Z"
                },
                {
                    "object_ref": "relationship--62e818b8-38e6-42ff-9424-9a327332eb2a",
                    "object_modified": "2026-04-29T14:23:06.059Z"
                },
                {
                    "object_ref": "relationship--630eb861-eb37-4258-9dbd-87789df2257a",
                    "object_modified": "2026-04-29T14:23:06.060Z"
                },
                {
                    "object_ref": "relationship--632ca9a0-a9f3-4b27-96e1-9fcb8bab11cb",
                    "object_modified": "2026-07-31T20:48:35.536Z"
                },
                {
                    "object_ref": "relationship--63323b12-86db-4b91-a701-90daf3f98f7c",
                    "object_modified": "2026-04-29T14:23:06.060Z"
                },
                {
                    "object_ref": "relationship--63453d2f-30f6-40ab-b32c-506d940ecd20",
                    "object_modified": "2026-04-29T14:23:06.060Z"
                },
                {
                    "object_ref": "relationship--636a70d1-dd76-4633-b960-e64459f87299",
                    "object_modified": "2026-04-29T14:23:06.060Z"
                },
                {
                    "object_ref": "relationship--639148fb-d0a5-4a2f-b6a3-a5ceb83d620b",
                    "object_modified": "2026-04-29T14:23:06.060Z"
                },
                {
                    "object_ref": "relationship--63be361c-72a7-4a17-923e-f7c957c29ae0",
                    "object_modified": "2026-09-25T19:15:26.200Z"
                },
                {
                    "object_ref": "relationship--63ca148e-12c9-4090-b51e-a8fb7a847a2a",
                    "object_modified": "2026-04-29T14:23:06.061Z"
                },
                {
                    "object_ref": "relationship--63f863e5-7c00-4474-8e43-bbe8bfb05cc3",
                    "object_modified": "2026-04-29T14:23:06.061Z"
                },
                {
                    "object_ref": "relationship--6420b4b9-3536-4a9b-b53d-6780242f38cf",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--6421e980-4f75-4e13-a207-a9583bd28c4a",
                    "object_modified": "2026-04-29T14:23:06.061Z"
                },
                {
                    "object_ref": "relationship--642cae89-bb5c-46f3-9fea-8d747b930c35",
                    "object_modified": "2026-07-31T20:48:16.199Z"
                },
                {
                    "object_ref": "relationship--642f4d65-04ea-4662-bc1c-5fba12aa4fc1",
                    "object_modified": "2026-04-29T14:23:06.061Z"
                },
                {
                    "object_ref": "relationship--645d5380-c5e5-4ee6-8ebb-11a0cd44cc08",
                    "object_modified": "2026-04-29T14:23:06.061Z"
                },
                {
                    "object_ref": "relationship--64db6a39-64d2-4999-97d7-91c28c32f42e",
                    "object_modified": "2026-04-29T14:23:06.062Z"
                },
                {
                    "object_ref": "relationship--64ebfc98-f9ad-40bd-9fe4-9e7fd9ffd2cf",
                    "object_modified": "2026-10-07T20:38:23.174Z"
                },
                {
                    "object_ref": "relationship--64f14b30-f71e-4429-b16e-160ae5e346f0",
                    "object_modified": "2026-04-29T14:23:06.062Z"
                },
                {
                    "object_ref": "relationship--64f31c4f-a525-469c-8f2f-370dcd321314",
                    "object_modified": "2026-04-29T14:23:06.062Z"
                },
                {
                    "object_ref": "relationship--650bca94-b9ad-45dd-90c9-83481247711a",
                    "object_modified": "2026-04-29T14:23:06.062Z"
                },
                {
                    "object_ref": "relationship--652a68a2-a26b-4e8c-86dd-fd83187ed043",
                    "object_modified": "2026-04-29T14:23:06.063Z"
                },
                {
                    "object_ref": "relationship--652c1e77-cfea-4452-9762-5ba16f874119",
                    "object_modified": "2026-09-03T20:28:48.948Z"
                },
                {
                    "object_ref": "relationship--6573327e-3757-424e-8570-04ffe7d5d0e2",
                    "object_modified": "2026-09-03T20:30:36.561Z"
                },
                {
                    "object_ref": "relationship--65aa5a0d-926c-4b04-9509-f66a99639877",
                    "object_modified": "2026-04-29T14:23:06.063Z"
                },
                {
                    "object_ref": "relationship--65ab0305-9fe2-4af4-a11e-b8d272493ad1",
                    "object_modified": "2026-04-29T14:23:06.063Z"
                },
                {
                    "object_ref": "relationship--65adbdda-7069-40ed-9825-b79ec87e4916",
                    "object_modified": "2026-07-31T20:48:31.959Z"
                },
                {
                    "object_ref": "relationship--65b57405-c7f6-432b-83ac-9571563250db",
                    "object_modified": "2026-09-25T16:43:43.575Z"
                },
                {
                    "object_ref": "relationship--65d42e15-749b-4f86-86c5-b9f1da1e60c5",
                    "object_modified": "2026-04-29T14:23:06.063Z"
                },
                {
                    "object_ref": "relationship--65e25631-05de-4ce2-88cc-52f91cfbdaf2",
                    "object_modified": "2026-09-03T20:28:48.961Z"
                },
                {
                    "object_ref": "relationship--6603a100-d655-4e6b-8d38-73c11b89dde4",
                    "object_modified": "2026-04-29T14:23:06.064Z"
                },
                {
                    "object_ref": "relationship--6637d8e6-6578-4d15-a993-d63ced4c4464",
                    "object_modified": "2026-04-29T14:23:06.064Z"
                },
                {
                    "object_ref": "relationship--665587ee-1524-4334-9580-2b448c417542",
                    "object_modified": "2026-04-29T14:23:06.064Z"
                },
                {
                    "object_ref": "relationship--6681bc38-0b55-4714-b690-c609956b40bf",
                    "object_modified": "2026-04-29T14:23:06.064Z"
                },
                {
                    "object_ref": "relationship--668f8c4b-225a-4287-ac5b-7717a4f75b5d",
                    "object_modified": "2026-07-31T20:48:16.210Z"
                },
                {
                    "object_ref": "relationship--66af47d7-c430-4ac9-8020-fd79b7059037",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--66d041e2-d9e8-46cc-88ee-8e5c1cec8702",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--66d8f3d7-68e0-48a0-a563-4746922080fc",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--66eb9d6f-498b-4a9a-94d3-fe808460bb68",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--66f79019-d52c-46a6-b605-c2335d1d3d20",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--671043a9-337f-411a-9ca9-3112e897ab09",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--672329b4-2695-4373-a2e4-0fc16c75cc13",
                    "object_modified": "2026-04-29T14:23:06.065Z"
                },
                {
                    "object_ref": "relationship--674a508f-ac54-41a8-9820-4a18c0ea86e4",
                    "object_modified": "2026-10-07T19:38:22.540Z"
                },
                {
                    "object_ref": "relationship--6754195a-99cd-4b45-bafd-4a374ae79bbd",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--67761911-5a46-445b-bf5e-a266330910b5",
                    "object_modified": "2026-10-07T21:21:43.311Z"
                },
                {
                    "object_ref": "relationship--6795c92f-848f-488e-9c25-d240f99c9b34",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--6797d89b-c631-4a45-90b8-7da2c703b6e7",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--679e7b8d-57d7-4c1d-8f42-1496606ea666",
                    "object_modified": "2026-07-31T20:48:28.007Z"
                },
                {
                    "object_ref": "relationship--67a85278-577c-4e8a-a668-83f43edb9742",
                    "object_modified": "2026-09-25T18:09:29.505Z"
                },
                {
                    "object_ref": "relationship--67ae8423-c401-4c11-93d3-0454c288d934",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--67dae594-4239-4756-a0bc-dee75de19e4c",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--67dd6b59-ef78-4732-beb8-4917156b6382",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--67e11f38-9f68-4989-8de3-da65af52063e",
                    "object_modified": "2026-04-29T14:23:06.066Z"
                },
                {
                    "object_ref": "relationship--67ed5edc-fd57-4b1c-9677-8f0758154526",
                    "object_modified": "2026-09-03T20:28:48.973Z"
                },
                {
                    "object_ref": "relationship--6833d534-9cbb-4b9f-85b6-93d3d2d6faca",
                    "object_modified": "2026-04-29T14:23:06.067Z"
                },
                {
                    "object_ref": "relationship--685249f9-e51a-4914-8b7f-09679e04198b",
                    "object_modified": "2026-04-29T14:23:06.067Z"
                },
                {
                    "object_ref": "relationship--686cbd74-ef49-4e77-9599-21777d3a4738",
                    "object_modified": "2026-04-29T14:23:06.067Z"
                },
                {
                    "object_ref": "relationship--6895e54e-3968-41a9-9013-a082cd46fa44",
                    "object_modified": "2026-07-31T20:48:50.259Z"
                },
                {
                    "object_ref": "relationship--68e0f740-e04d-492c-b735-ce75f86a62f5",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--692240ba-667e-4f37-9f35-f354240c5bdc",
                    "object_modified": "2026-04-29T14:23:06.068Z"
                },
                {
                    "object_ref": "relationship--692324b4-064a-430c-8ffc-7f7acd537778",
                    "object_modified": "2026-06-12T16:01:16.020Z"
                },
                {
                    "object_ref": "relationship--692ff921-c74d-40a4-ab31-879aba5f247a",
                    "object_modified": "2026-04-29T14:23:06.068Z"
                },
                {
                    "object_ref": "relationship--69576d3c-d0e8-459e-9f2e-0b9c560b2e04",
                    "object_modified": "2026-04-29T14:23:06.068Z"
                },
                {
                    "object_ref": "relationship--69889c90-e6d0-4007-9078-2bfbd7c18a91",
                    "object_modified": "2026-07-31T20:48:17.836Z"
                },
                {
                    "object_ref": "relationship--698d7c50-daab-4087-a7b4-b2bc8dfd81a7",
                    "object_modified": "2026-04-29T14:23:06.069Z"
                },
                {
                    "object_ref": "relationship--69963190-c0a1-4518-922f-0f6153e1f6a6",
                    "object_modified": "2026-04-29T14:23:06.069Z"
                },
                {
                    "object_ref": "relationship--69cf4015-fae1-47f6-9253-1f99209288a5",
                    "object_modified": "2026-04-29T14:23:06.069Z"
                },
                {
                    "object_ref": "relationship--69d19946-72fb-40ce-90fb-0757df8353b5",
                    "object_modified": "2026-09-03T20:30:36.574Z"
                },
                {
                    "object_ref": "relationship--69f5ca66-8334-47e1-920e-b9320e007c3b",
                    "object_modified": "2026-04-29T14:23:06.069Z"
                },
                {
                    "object_ref": "relationship--69f9597e-a47d-49bb-a182-376349f979ef",
                    "object_modified": "2026-04-29T14:23:06.069Z"
                },
                {
                    "object_ref": "relationship--6a314797-9105-44e3-be5f-41b817454daf",
                    "object_modified": "2026-04-29T14:23:06.070Z"
                },
                {
                    "object_ref": "relationship--6a34bec1-cb83-4af8-ae74-701f299e634d",
                    "object_modified": "2026-10-07T20:20:39.700Z"
                },
                {
                    "object_ref": "relationship--6a476f56-2c07-43be-8054-d978ee8eb924",
                    "object_modified": "2026-04-29T14:23:06.070Z"
                },
                {
                    "object_ref": "relationship--6ad39b3a-a962-457f-852c-be7fc615e22f",
                    "object_modified": "2026-04-29T14:23:06.070Z"
                },
                {
                    "object_ref": "relationship--6ad3b5cc-7ba1-4287-8c05-d02385f84f72",
                    "object_modified": "2026-04-29T14:23:06.070Z"
                },
                {
                    "object_ref": "relationship--6b0e8f60-ecdf-4140-9741-5b50df67353c",
                    "object_modified": "2026-07-31T20:48:17.844Z"
                },
                {
                    "object_ref": "relationship--6b33ae4d-2c8b-434f-994e-7e0b1413ff2c",
                    "object_modified": "2026-04-29T14:23:06.071Z"
                },
                {
                    "object_ref": "relationship--6b5d2643-b399-43aa-8ab1-7557a0446b07",
                    "object_modified": "2026-04-29T14:23:06.071Z"
                },
                {
                    "object_ref": "relationship--6b5fd6d8-ef70-4896-b1a4-7b6c29c3a0d4",
                    "object_modified": "2026-04-29T14:23:06.071Z"
                },
                {
                    "object_ref": "relationship--6bbb12c3-171d-45a5-a01b-a74b0c0704f0",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6be4cef2-3d54-4cd8-97df-8a8b37c03605",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6c15ec9f-2b48-419c-adc1-f989833f6187",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6c20bab8-3b4d-4cbc-83f5-ad032c7ecde3",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6c31c795-935a-41ad-8db1-d74430f4a553",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6c470aa0-b119-4078-80fc-2b66a4d6eac4",
                    "object_modified": "2026-04-29T14:23:06.072Z"
                },
                {
                    "object_ref": "relationship--6c9c1c11-c996-4d2b-bbed-d73ae30efd2e",
                    "object_modified": "2026-04-29T14:23:06.073Z"
                },
                {
                    "object_ref": "relationship--6cce7a41-335a-4481-a574-1d0cc75cd6b4",
                    "object_modified": "2026-10-07T21:46:54.383Z"
                },
                {
                    "object_ref": "relationship--6ce3bd17-de4c-4ff3-9f7d-ae30efae2b58",
                    "object_modified": "2026-04-29T14:23:06.073Z"
                },
                {
                    "object_ref": "relationship--6d1906b4-e815-4688-86f1-ce61d403f8c6",
                    "object_modified": "2026-04-29T14:23:06.074Z"
                },
                {
                    "object_ref": "relationship--6d822f86-5793-403a-b176-5d533f6b81b3",
                    "object_modified": "2026-04-29T14:23:06.074Z"
                },
                {
                    "object_ref": "relationship--6dcbeaa1-5254-4a6a-a34d-07f6dc874a13",
                    "object_modified": "2026-10-07T20:31:32.049Z"
                },
                {
                    "object_ref": "relationship--6e37ae60-f8db-4305-8235-8711c6cb8a4a",
                    "object_modified": "2026-04-29T14:23:06.075Z"
                },
                {
                    "object_ref": "relationship--6e5b9baf-8d51-4b1e-a0c4-09d4da904160",
                    "object_modified": "2026-04-29T14:23:06.075Z"
                },
                {
                    "object_ref": "relationship--6eafa3e9-f53f-43b5-ac24-1415b05b537f",
                    "object_modified": "2026-04-29T14:23:06.076Z"
                },
                {
                    "object_ref": "relationship--6ec8c4c2-9bfc-43ef-a634-f43cb951e06e",
                    "object_modified": "2026-04-29T14:23:06.076Z"
                },
                {
                    "object_ref": "relationship--6ed07095-c23a-4676-807f-a544deaeb274",
                    "object_modified": "2026-04-29T14:23:06.076Z"
                },
                {
                    "object_ref": "relationship--6f0384e6-73c8-4fc7-bc0c-0a8c2bfa473d",
                    "object_modified": "2026-04-29T14:23:06.076Z"
                },
                {
                    "object_ref": "relationship--6f122824-1a91-4717-aaf6-3db95d04bca1",
                    "object_modified": "2026-10-07T20:31:51.956Z"
                },
                {
                    "object_ref": "relationship--6f1479d9-dfd4-4baa-abd5-9847781ef9bf",
                    "object_modified": "2026-04-29T14:23:06.076Z"
                },
                {
                    "object_ref": "relationship--6f269b4c-b338-4b62-8a1a-f08268999b5c",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f2c2043-6487-467a-bb49-e8cd2509ae9f",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f2ddada-d7df-4788-b5d1-9add185142e0",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f72c60e-2739-40b6-b6a9-66d2a3d1833e",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f815d4c-0512-4d92-bcdf-068034233048",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f950c91-125b-46a0-aa40-239b4de2306a",
                    "object_modified": "2026-04-29T14:23:06.077Z"
                },
                {
                    "object_ref": "relationship--6f9e3f69-ac1c-479e-ae2d-73dd1413d4dd",
                    "object_modified": "2026-04-29T14:23:06.078Z"
                },
                {
                    "object_ref": "relationship--6fa3aee4-2a29-4c0f-9e61-1f7df5eccc00",
                    "object_modified": "2026-04-29T14:23:06.078Z"
                },
                {
                    "object_ref": "relationship--6fb4c5ec-4079-4419-a098-6e3cf026c360",
                    "object_modified": "2026-08-04T20:48:44.898Z"
                },
                {
                    "object_ref": "relationship--6ff846b1-9444-45f1-837a-4eeeb16bdfe7",
                    "object_modified": "2026-04-29T14:23:06.078Z"
                },
                {
                    "object_ref": "relationship--703adc98-d4d1-409e-bf20-4e65921ae52f",
                    "object_modified": "2026-04-29T14:23:06.078Z"
                },
                {
                    "object_ref": "relationship--7041d8e5-3b74-402a-86b3-fd59def80632",
                    "object_modified": "2026-04-29T14:23:06.078Z"
                },
                {
                    "object_ref": "relationship--7050acd5-637b-4581-b58e-dcfac3eb1bb5",
                    "object_modified": "2026-10-08T21:35:55.577Z"
                },
                {
                    "object_ref": "relationship--706bf21c-0722-43b3-8729-60370f648796",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--706cdbae-6bb6-42c5-8d15-2f066cc3b19c",
                    "object_modified": "2026-10-07T20:18:49.448Z"
                },
                {
                    "object_ref": "relationship--70e47417-e7ae-4558-8382-6582e897869c",
                    "object_modified": "2026-09-25T19:12:31.959Z"
                },
                {
                    "object_ref": "relationship--71422483-33e4-4131-a4ec-40322d91d8a0",
                    "object_modified": "2026-04-29T14:23:06.080Z"
                },
                {
                    "object_ref": "relationship--71a2c3f5-7383-4bd8-a830-dc2aae62a977",
                    "object_modified": "2026-04-29T14:23:06.080Z"
                },
                {
                    "object_ref": "relationship--71a8d11d-a5ef-4025-819a-2627e4fe7b04",
                    "object_modified": "2026-10-07T21:41:02.904Z"
                },
                {
                    "object_ref": "relationship--71c9db9c-6f0c-4e33-a20a-dcd5b791a49a",
                    "object_modified": "2026-04-29T14:23:06.081Z"
                },
                {
                    "object_ref": "relationship--71e9230d-eec8-4ce1-bc96-9288bacc8b13",
                    "object_modified": "2026-04-29T14:23:06.081Z"
                },
                {
                    "object_ref": "relationship--71f61677-4406-4484-bacb-c8de82c7e1bd",
                    "object_modified": "2026-07-31T20:48:57.949Z"
                },
                {
                    "object_ref": "relationship--7200f777-0ddd-4c9c-a022-26d49ea524d3",
                    "object_modified": "2026-04-29T14:23:06.081Z"
                },
                {
                    "object_ref": "relationship--7258c355-677c-452d-b1fc-27767232437b",
                    "object_modified": "2026-04-29T14:23:06.081Z"
                },
                {
                    "object_ref": "relationship--72848957-910f-4fa5-8a59-383c0a9dae62",
                    "object_modified": "2026-04-29T14:23:06.082Z"
                },
                {
                    "object_ref": "relationship--72a284ef-1b88-40b1-8ab0-af6e2911f7cd",
                    "object_modified": "2026-09-25T18:36:04.994Z"
                },
                {
                    "object_ref": "relationship--730580d4-d68c-407f-9d09-f379e9aefc7e",
                    "object_modified": "2026-04-29T14:23:06.082Z"
                },
                {
                    "object_ref": "relationship--73093c08-ea39-4956-8bff-55e15f6630cd",
                    "object_modified": "2026-04-29T14:23:06.082Z"
                },
                {
                    "object_ref": "relationship--7318e20b-4f7e-4ba5-b293-b759f7a2e3c7",
                    "object_modified": "2026-10-07T20:07:30.151Z"
                },
                {
                    "object_ref": "relationship--73856fa4-5abb-4341-bf51-1874cc1e6c26",
                    "object_modified": "2026-07-31T20:48:19.758Z"
                },
                {
                    "object_ref": "relationship--73c358d5-f4ce-4ce5-aa3d-d2ede8aff148",
                    "object_modified": "2026-04-29T14:23:06.083Z"
                },
                {
                    "object_ref": "relationship--73dbe470-0d10-493b-b0ae-241da7dc0b58",
                    "object_modified": "2026-09-03T20:31:27.536Z"
                },
                {
                    "object_ref": "relationship--73eaa82f-9ab0-430d-86b8-64ea85b18c91",
                    "object_modified": "2026-07-31T20:48:14.195Z"
                },
                {
                    "object_ref": "relationship--73eaaabd-7c35-46d1-8ca7-df185a5d1cff",
                    "object_modified": "2026-10-07T20:37:45.282Z"
                },
                {
                    "object_ref": "relationship--73ed52f4-4a98-47e7-84bf-5eae555d999d",
                    "object_modified": "2026-04-29T14:23:06.084Z"
                },
                {
                    "object_ref": "relationship--740082b7-2411-473a-a59d-4d46cf12f8b5",
                    "object_modified": "2026-04-29T14:23:06.084Z"
                },
                {
                    "object_ref": "relationship--7411b05d-209a-4907-83ce-00ab1538fbac",
                    "object_modified": "2026-09-03T20:31:27.547Z"
                },
                {
                    "object_ref": "relationship--745b5268-f2b3-499c-a6a4-63d7e8667ff7",
                    "object_modified": "2026-04-29T14:23:06.084Z"
                },
                {
                    "object_ref": "relationship--74a6f16c-3a23-4cac-8592-fc363960f9df",
                    "object_modified": "2026-04-29T14:23:06.085Z"
                },
                {
                    "object_ref": "relationship--74b66248-2cb6-46ea-b52c-c7d60c170f3f",
                    "object_modified": "2026-04-29T14:23:06.085Z"
                },
                {
                    "object_ref": "relationship--74ec9ce5-3155-488c-ae56-570c47a1d207",
                    "object_modified": "2026-04-29T14:23:06.085Z"
                },
                {
                    "object_ref": "relationship--751ee4bc-6b32-4c3d-b8c0-f73f9295ddd2",
                    "object_modified": "2026-10-07T21:54:40.895Z"
                },
                {
                    "object_ref": "relationship--754521fc-4306-4daa-831b-6b6fb45847e2",
                    "object_modified": "2026-04-29T14:23:06.085Z"
                },
                {
                    "object_ref": "relationship--7584e57f-1258-4c47-b18d-99019a586e6c",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--758773e3-d23d-44db-b5d3-643cde5b41f1",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--758d5818-f919-4a6b-9dc2-a212595a11bd",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--75911ed1-3cd0-485d-8130-3aae06712f4a",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--75b17842-7614-4c52-9a78-db096f8b653c",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--75c27f4e-d1e3-490a-9793-a6fc8e326a48",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--75e6adae-06a7-47e9-878e-74ca73004c3b",
                    "object_modified": "2026-04-29T14:23:06.086Z"
                },
                {
                    "object_ref": "relationship--75f486d8-c651-40ba-8e2e-81ee6c924ffc",
                    "object_modified": "2026-04-29T14:23:06.087Z"
                },
                {
                    "object_ref": "relationship--76537fd7-5782-4a8d-9b54-117b168a4306",
                    "object_modified": "2026-04-29T14:23:06.087Z"
                },
                {
                    "object_ref": "relationship--768b6ce0-8b1c-4424-a9e7-ee659a948fa9",
                    "object_modified": "2026-04-29T14:23:06.087Z"
                },
                {
                    "object_ref": "relationship--76c3caa4-bc2a-437d-9826-3d32a78ff76a",
                    "object_modified": "2026-09-26T05:40:17.349Z"
                },
                {
                    "object_ref": "relationship--76cf41a1-f340-401c-b640-bf7fe5143f56",
                    "object_modified": "2026-04-29T14:23:06.088Z"
                },
                {
                    "object_ref": "relationship--77566f94-5e26-41c9-892f-2f62b395afe7",
                    "object_modified": "2026-04-29T14:23:06.088Z"
                },
                {
                    "object_ref": "relationship--779d3d69-f079-4bee-b7ac-3d5164b9ec6d",
                    "object_modified": "2026-04-29T14:23:06.089Z"
                },
                {
                    "object_ref": "relationship--77f3a64d-227d-487f-8484-89007e05b59f",
                    "object_modified": "2026-04-29T14:23:06.089Z"
                },
                {
                    "object_ref": "relationship--78881a3d-59ad-4fbb-8bd2-69388a068584",
                    "object_modified": "2026-04-29T14:23:06.090Z"
                },
                {
                    "object_ref": "relationship--792324b4-064a-430c-8ffc-7f7acd537778",
                    "object_modified": "2026-06-12T16:02:27.291Z"
                },
                {
                    "object_ref": "relationship--79235599-e23f-43cb-9c56-1eb22b7c4664",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--79259f05-a677-4512-bb57-8c3137d303ba",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--79324bdd-cdab-4d0a-af60-af1047c1d117",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--79407d1e-8e16-48c1-939c-ad92f91dd988",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--79516dd8-72de-4372-bfce-b7f4a98b98d7",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--7978037f-e332-4b31-9b6f-c3f5719f735b",
                    "object_modified": "2026-10-07T21:21:09.762Z"
                },
                {
                    "object_ref": "relationship--798919d3-df8b-463f-b2be-4c1aa8089384",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--798de2f3-218b-4622-a62c-84e3840d45a6",
                    "object_modified": "2026-04-29T14:23:06.091Z"
                },
                {
                    "object_ref": "relationship--799951e5-ab80-4b13-a136-7fbcab4e19af",
                    "object_modified": "2026-04-29T14:23:06.092Z"
                },
                {
                    "object_ref": "relationship--79c6d710-baf4-411e-a3f5-9cb8d42b7c19",
                    "object_modified": "2026-04-29T14:23:06.092Z"
                },
                {
                    "object_ref": "relationship--79d05cb2-ded0-4847-b52e-af7af421f303",
                    "object_modified": "2026-04-29T14:23:06.092Z"
                },
                {
                    "object_ref": "relationship--7a19d6d4-19dd-4058-b1bf-28a7c41ee4b1",
                    "object_modified": "2026-09-25T20:29:33.330Z"
                },
                {
                    "object_ref": "relationship--7a29d34a-08fd-4aeb-8968-22856ad7429a",
                    "object_modified": "2026-04-29T14:23:06.092Z"
                },
                {
                    "object_ref": "relationship--7a3fbac8-c666-4564-b02a-ea199bbcb2a5",
                    "object_modified": "2026-04-29T14:23:06.093Z"
                },
                {
                    "object_ref": "relationship--7a55fc66-0d5c-4ef6-af28-d4a4bb84381d",
                    "object_modified": "2026-04-29T14:23:06.093Z"
                },
                {
                    "object_ref": "relationship--7ad4a725-8eb7-45b3-bfd7-f9bd29cc5970",
                    "object_modified": "2026-04-29T14:23:06.093Z"
                },
                {
                    "object_ref": "relationship--7b1e00af-11fb-4862-a193-55dc9b6652c0",
                    "object_modified": "2026-04-29T14:23:06.094Z"
                },
                {
                    "object_ref": "relationship--7b814e39-71fc-4e99-b46f-b24eca6cc780",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7b8f6d2b-3091-4b0f-9987-88cd344007a1",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--7b923320-8cb7-4d47-bedc-25a96560a7d0",
                    "object_modified": "2026-10-07T21:53:16.233Z"
                },
                {
                    "object_ref": "relationship--7b95b2aa-9561-494f-8e02-d36edc14e38b",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7bb1dbec-7314-479a-9496-86f8e25041eb",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7bbe6ac7-d0fb-40e4-8537-bdded7173f07",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7bd46875-7d59-4d65-8f9b-d48d3cb54a84",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7be2d11d-87be-4d1c-8f5b-b7e59ad191ea",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7bfaf0ff-6d88-460f-aa32-3fb0267b4f20",
                    "object_modified": "2026-09-03T20:28:48.999Z"
                },
                {
                    "object_ref": "relationship--7c1eee62-3307-4e25-8a20-919ccd56ec1c",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7c35a530-27eb-42e7-9101-e6e6205df682",
                    "object_modified": "2026-10-07T21:16:28.884Z"
                },
                {
                    "object_ref": "relationship--7c3b65e8-e8b7-4c3b-b27b-e216986d8976",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7c433b29-0ad3-4574-990f-e3d6291e7f23",
                    "object_modified": "2026-04-29T14:23:06.095Z"
                },
                {
                    "object_ref": "relationship--7c7777a0-f96a-414c-b294-e9f0744bf8b8",
                    "object_modified": "2026-04-29T14:23:06.096Z"
                },
                {
                    "object_ref": "relationship--7c893581-c847-495a-aa93-9d98c516e1ae",
                    "object_modified": "2026-04-29T14:23:06.096Z"
                },
                {
                    "object_ref": "relationship--7ce83371-b84d-4a9e-b2d3-637dc7bf9844",
                    "object_modified": "2026-10-07T21:15:16.324Z"
                },
                {
                    "object_ref": "relationship--7cfaea56-6125-4aad-a491-ce2f54a88c24",
                    "object_modified": "2026-04-29T14:23:06.096Z"
                },
                {
                    "object_ref": "relationship--7d42ba22-9595-4463-8dda-c0e47a154fed",
                    "object_modified": "2026-04-29T14:23:06.097Z"
                },
                {
                    "object_ref": "relationship--7d5759cd-890e-4ec5-b92b-aba225d52960",
                    "object_modified": "2026-04-29T14:23:06.097Z"
                },
                {
                    "object_ref": "relationship--7d752615-33f0-44ed-a156-25d84f384e75",
                    "object_modified": "2026-08-04T20:48:44.923Z"
                },
                {
                    "object_ref": "relationship--7db9687b-7099-4cb6-a040-bc32fc549a81",
                    "object_modified": "2026-04-29T14:23:06.097Z"
                },
                {
                    "object_ref": "relationship--7dd11d5e-1c1c-4f94-b4bf-4fd59988539b",
                    "object_modified": "2026-04-29T14:23:06.097Z"
                },
                {
                    "object_ref": "relationship--7de5de32-6f37-4419-97b8-77eb9d69be40",
                    "object_modified": "2026-04-29T14:23:06.097Z"
                },
                {
                    "object_ref": "relationship--7dedeb73-ef90-4282-a635-cc37326773af",
                    "object_modified": "2026-09-03T20:31:27.561Z"
                },
                {
                    "object_ref": "relationship--7e0531c4-fb87-4d66-9595-024a08a71598",
                    "object_modified": "2026-04-20T20:54:20.734Z"
                },
                {
                    "object_ref": "relationship--7ed1ad67-942a-424e-ad81-8b69a4f0c706",
                    "object_modified": "2026-04-29T14:23:06.099Z"
                },
                {
                    "object_ref": "relationship--7efa1a31-da21-4925-aab0-96a012d5b2a7",
                    "object_modified": "2026-04-29T14:23:06.099Z"
                },
                {
                    "object_ref": "relationship--7f3ee61b-3ef1-41da-9853-6520a2ea942d",
                    "object_modified": "2026-04-29T14:23:06.099Z"
                },
                {
                    "object_ref": "relationship--7f4b7026-a747-49db-9b28-aff3de16afb2",
                    "object_modified": "2026-10-07T17:50:10.919Z"
                },
                {
                    "object_ref": "relationship--7f520bef-d179-415a-b921-d30ff60d2284",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--7fdaa9be-aecf-459f-b028-7c35dc8b6451",
                    "object_modified": "2026-04-29T14:23:06.100Z"
                },
                {
                    "object_ref": "relationship--7ff12adb-bc9a-42e5-9cbf-613b200c36dc",
                    "object_modified": "2026-04-29T14:23:06.100Z"
                },
                {
                    "object_ref": "relationship--80250a66-dec0-4ef5-8a76-b3aa24fe5bc3",
                    "object_modified": "2026-04-29T14:23:06.101Z"
                },
                {
                    "object_ref": "relationship--808174b7-3ab0-45b5-963e-5c10dd749e3c",
                    "object_modified": "2026-04-29T14:23:06.101Z"
                },
                {
                    "object_ref": "relationship--808c57e7-72ef-4860-b9ea-8ea072e2385a",
                    "object_modified": "2026-04-29T14:23:06.101Z"
                },
                {
                    "object_ref": "relationship--80a69b56-337d-446a-8167-8b9f63083c4f",
                    "object_modified": "2026-04-29T14:23:06.101Z"
                },
                {
                    "object_ref": "relationship--80cf98bd-b7dc-45cf-91a6-4ab6b79a7f0b",
                    "object_modified": "2026-04-29T14:23:06.101Z"
                },
                {
                    "object_ref": "relationship--80d77b53-6aa4-4703-946f-6c7f0748f823",
                    "object_modified": "2026-04-29T14:23:06.102Z"
                },
                {
                    "object_ref": "relationship--81029694-8a6d-49f5-a053-ee2e29c086c7",
                    "object_modified": "2026-04-29T14:23:06.102Z"
                },
                {
                    "object_ref": "relationship--81055366-e78b-40e0-a799-4b536ba03db3",
                    "object_modified": "2026-04-29T14:23:06.102Z"
                },
                {
                    "object_ref": "relationship--81722115-69d3-4769-89e5-53491504d9c4",
                    "object_modified": "2026-09-26T02:55:08.718Z"
                },
                {
                    "object_ref": "relationship--81806f43-c9aa-486e-8032-4e4665ba0d39",
                    "object_modified": "2026-04-29T14:23:06.102Z"
                },
                {
                    "object_ref": "relationship--818ce9d0-8fc2-4a34-a062-f0e6995bdf32",
                    "object_modified": "2026-04-29T14:23:06.103Z"
                },
                {
                    "object_ref": "relationship--81ca994a-b350-424d-8f39-a0b64aa76260",
                    "object_modified": "2026-04-29T14:23:06.103Z"
                },
                {
                    "object_ref": "relationship--81cd1138-ca48-4c06-8964-3fe007b3593a",
                    "object_modified": "2026-04-29T14:23:06.103Z"
                },
                {
                    "object_ref": "relationship--81fd1ae0-e3ef-40b7-86d8-89c85fd86100",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--825cea69-6545-40c3-9a56-1ace30fc7dca",
                    "object_modified": "2026-09-25T19:17:57.024Z"
                },
                {
                    "object_ref": "relationship--82810cd2-99e9-4ef6-b3fb-0a7a47d76661",
                    "object_modified": "2026-04-29T14:23:06.104Z"
                },
                {
                    "object_ref": "relationship--82b20c35-88c6-49aa-8241-a59512b17b74",
                    "object_modified": "2026-04-29T14:23:06.104Z"
                },
                {
                    "object_ref": "relationship--82c3a26d-0bb9-49f1-8586-e15ce5e67df7",
                    "object_modified": "2026-09-25T19:14:38.505Z"
                },
                {
                    "object_ref": "relationship--834b1fa4-ee6d-43c7-9e07-1b6a47dee4a2",
                    "object_modified": "2026-04-29T14:23:06.105Z"
                },
                {
                    "object_ref": "relationship--83a964cb-730c-44e4-859b-b5246159396b",
                    "object_modified": "2026-04-29T14:23:06.105Z"
                },
                {
                    "object_ref": "relationship--83c29179-4805-403a-acf5-5151c4d2e556",
                    "object_modified": "2026-04-29T14:23:06.105Z"
                },
                {
                    "object_ref": "relationship--83c8c216-7ff7-4bd3-9db4-573469628d95",
                    "object_modified": "2026-04-29T14:23:06.105Z"
                },
                {
                    "object_ref": "relationship--841ec349-0f4c-43fa-89b8-ef3656497fc9",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--842a2b85-4e77-4eb6-99e1-c4a231aadf48",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--8465924f-8201-43c4-bd7c-961215f839d0",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--84671396-a556-4a5d-9bb9-cac697277371",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--8474e6ef-39c4-4ecc-ba5a-cbd9b32b5c65",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--847962a8-3dfd-4b8c-81a8-dc8284766109",
                    "object_modified": "2026-04-29T14:23:06.106Z"
                },
                {
                    "object_ref": "relationship--84b0a0f5-79e6-4e18-a7fe-0a0427911416",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--84d9ff92-234f-4b11-a350-fad07941ff3e",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--84fa50ff-bb84-4ab6-b759-658c57532c42",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--84fd1e14-44a8-4eac-9bfc-67b50ea1acf7",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--8530c1ea-fe9f-4b04-be34-7404d5e30e75",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--856cf76e-5058-41f0-ae71-6cb463fc36c7",
                    "object_modified": "2026-04-29T14:23:06.107Z"
                },
                {
                    "object_ref": "relationship--85b1bbb1-458f-4be3-8bd9-ef0fa23179ee",
                    "object_modified": "2026-04-29T14:23:06.108Z"
                },
                {
                    "object_ref": "relationship--85cd5c54-08b9-49e4-8a26-cc6c84704908",
                    "object_modified": "2026-09-25T19:16:38.404Z"
                },
                {
                    "object_ref": "relationship--862d5dbb-4582-4a9b-877a-e323233b53fe",
                    "object_modified": "2026-10-09T00:04:44.482Z"
                },
                {
                    "object_ref": "relationship--86668811-c57b-4aba-860f-22ca4d7b9600",
                    "object_modified": "2026-04-29T14:23:06.109Z"
                },
                {
                    "object_ref": "relationship--868db512-b897-4a54-ae56-ac78f6c93a14",
                    "object_modified": "2026-09-03T20:31:39.296Z"
                },
                {
                    "object_ref": "relationship--86a8d6aa-beff-4343-a0b2-dd099202b2dc",
                    "object_modified": "2026-04-29T14:23:06.109Z"
                },
                {
                    "object_ref": "relationship--86d04319-a13e-4105-9def-c659360c4613",
                    "object_modified": "2026-04-29T14:23:06.109Z"
                },
                {
                    "object_ref": "relationship--86f1655a-db46-4d49-9051-6653da83eb13",
                    "object_modified": "2026-04-29T14:23:06.109Z"
                },
                {
                    "object_ref": "relationship--86fef801-720c-4dcc-a970-211cb442a1fc",
                    "object_modified": "2026-10-07T20:37:33.243Z"
                },
                {
                    "object_ref": "relationship--86ff60b6-f5a1-4c18-a3ba-30843c73ba84",
                    "object_modified": "2026-10-07T20:20:10.677Z"
                },
                {
                    "object_ref": "relationship--872791ff-b341-4774-b275-d3c80c152746",
                    "object_modified": "2026-10-07T21:15:31.882Z"
                },
                {
                    "object_ref": "relationship--875296e5-6aba-4a44-a884-2419ea17b721",
                    "object_modified": "2026-10-07T20:18:24.428Z"
                },
                {
                    "object_ref": "relationship--876e4a50-7c73-4733-bad0-e3a701adf059",
                    "object_modified": "2026-04-29T14:23:06.110Z"
                },
                {
                    "object_ref": "relationship--87a546cf-387f-48c6-9b0f-1179af49be88",
                    "object_modified": "2026-04-29T14:23:06.110Z"
                },
                {
                    "object_ref": "relationship--87c8ab74-576d-4962-b641-0762d374d1e8",
                    "object_modified": "2026-04-29T14:23:06.110Z"
                },
                {
                    "object_ref": "relationship--881abd90-78d3-4f25-ab87-e7e8b031c98d",
                    "object_modified": "2026-09-25T18:35:12.134Z"
                },
                {
                    "object_ref": "relationship--88330b9a-d79c-4956-b1bb-81036164e2c0",
                    "object_modified": "2026-10-07T19:37:41.978Z"
                },
                {
                    "object_ref": "relationship--88363abe-64e6-4a4a-9d6e-e9a886f1d372",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--88402181-99da-4c51-93d2-5203ee139da5",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--8869fa66-e54f-4c03-8290-a86a0cd0d8d6",
                    "object_modified": "2026-04-29T14:23:06.111Z"
                },
                {
                    "object_ref": "relationship--88c470f0-7214-4a2b-bd35-3c71733ce392",
                    "object_modified": "2026-04-29T14:23:06.112Z"
                },
                {
                    "object_ref": "relationship--88cadeca-4012-4716-a095-9e1c79e59ec3",
                    "object_modified": "2026-04-29T14:23:06.112Z"
                },
                {
                    "object_ref": "relationship--88edcf36-a6f2-474f-b9c2-7800b34919a2",
                    "object_modified": "2026-04-29T14:23:06.112Z"
                },
                {
                    "object_ref": "relationship--890ddf20-18a6-4d23-98dd-970478133169",
                    "object_modified": "2026-04-29T14:23:06.112Z"
                },
                {
                    "object_ref": "relationship--89291706-4233-47c2-9b3e-b59bc01fcd80",
                    "object_modified": "2026-10-07T21:55:19.393Z"
                },
                {
                    "object_ref": "relationship--896e91ed-b145-43c2-a4c6-aa768fcb5293",
                    "object_modified": "2026-09-03T20:30:36.600Z"
                },
                {
                    "object_ref": "relationship--897cfc36-4253-4e1e-8825-726dbe9088a2",
                    "object_modified": "2026-04-29T14:23:06.113Z"
                },
                {
                    "object_ref": "relationship--898a9eb9-671e-4096-8288-72ffb49e93f3",
                    "object_modified": "2026-04-29T14:23:06.113Z"
                },
                {
                    "object_ref": "relationship--89923285-812d-4a09-8536-bf41943e8229",
                    "object_modified": "2026-09-26T05:29:35.355Z"
                },
                {
                    "object_ref": "relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd",
                    "object_modified": "2026-04-29T14:23:06.113Z"
                },
                {
                    "object_ref": "relationship--8a3a5d90-a030-479e-b38d-d7d749f327d1",
                    "object_modified": "2026-04-29T14:23:06.114Z"
                },
                {
                    "object_ref": "relationship--8a765743-9caf-4c8a-9c58-6fe2c1993108",
                    "object_modified": "2026-04-29T14:23:06.114Z"
                },
                {
                    "object_ref": "relationship--8a7c4419-b2c6-4774-bcba-a28fc6c5bcce",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--8a80c4f3-8f5b-4b22-b2e8-ad472d4df89d",
                    "object_modified": "2026-04-29T14:23:06.114Z"
                },
                {
                    "object_ref": "relationship--8a86ad59-dff1-46dc-8ffd-3c62b96c6e62",
                    "object_modified": "2026-09-03T20:31:39.313Z"
                },
                {
                    "object_ref": "relationship--8a9fde66-7874-4418-8652-d8a987c0b5df",
                    "object_modified": "2026-04-29T14:23:06.114Z"
                },
                {
                    "object_ref": "relationship--8ab684f0-96e1-4a4f-b139-44afd8d093f2",
                    "object_modified": "2026-04-29T14:23:06.114Z"
                },
                {
                    "object_ref": "relationship--8af19674-6836-4d21-abfc-593252b282cb",
                    "object_modified": "2026-09-25T18:36:42.795Z"
                },
                {
                    "object_ref": "relationship--8b17ad46-b0cc-4766-9cae-eba32260d468",
                    "object_modified": "2026-04-29T14:23:06.115Z"
                },
                {
                    "object_ref": "relationship--8b2d82aa-75fc-4d6d-bb4b-9f600bd211fd",
                    "object_modified": "2026-09-03T20:30:36.612Z"
                },
                {
                    "object_ref": "relationship--8b303086-8ae7-415b-b46d-16ce814aa94f",
                    "object_modified": "2026-04-29T14:23:06.115Z"
                },
                {
                    "object_ref": "relationship--8b3f5b8c-789e-4f61-8e5c-fb28f8662d32",
                    "object_modified": "2026-04-29T14:23:06.115Z"
                },
                {
                    "object_ref": "relationship--8b698bb5-5b69-4137-a3d4-f3acf251f87b",
                    "object_modified": "2026-04-29T14:23:06.115Z"
                },
                {
                    "object_ref": "relationship--8b7403f5-90d2-4d2c-a484-87d29f419a9f",
                    "object_modified": "2026-08-04T20:48:45.002Z"
                },
                {
                    "object_ref": "relationship--8c03fd0a-646f-4d79-83fc-8ec428191810",
                    "object_modified": "2026-04-20T20:54:24.019Z"
                },
                {
                    "object_ref": "relationship--8c523980-7db0-4173-9df4-eba2c36f6655",
                    "object_modified": "2026-04-29T14:23:06.117Z"
                },
                {
                    "object_ref": "relationship--8c5e273e-eec7-4ac8-881c-1c46717cf924",
                    "object_modified": "2026-10-07T20:31:17.072Z"
                },
                {
                    "object_ref": "relationship--8c6fe57d-3344-4fe7-b547-a3c5046960bb",
                    "object_modified": "2026-04-29T14:23:06.117Z"
                },
                {
                    "object_ref": "relationship--8ca2fe75-9bb3-4af5-8fee-accd33d6d2ec",
                    "object_modified": "2026-04-29T14:23:06.117Z"
                },
                {
                    "object_ref": "relationship--8ccd5f5c-420a-413b-81ef-5e40f401be95",
                    "object_modified": "2026-04-29T14:23:06.117Z"
                },
                {
                    "object_ref": "relationship--8d0793f1-e818-4632-8fb6-8c4aa5c7f073",
                    "object_modified": "2026-07-31T20:48:13.560Z"
                },
                {
                    "object_ref": "relationship--8d0d6365-7bc0-417d-9268-c7c31fcb0d91",
                    "object_modified": "2026-08-04T20:48:45.018Z"
                },
                {
                    "object_ref": "relationship--8d392c6e-1368-4c6f-a189-aaf4c6355e55",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--8d39646f-b224-4209-8c05-15002ea797b9",
                    "object_modified": "2026-04-29T14:23:06.118Z"
                },
                {
                    "object_ref": "relationship--8d4d0ce4-ca42-4a05-a959-89d6af2650e2",
                    "object_modified": "2026-04-29T14:23:06.118Z"
                },
                {
                    "object_ref": "relationship--8d7e2aa5-129a-4060-88ae-9fc066af13c7",
                    "object_modified": "2026-04-29T14:23:06.118Z"
                },
                {
                    "object_ref": "relationship--8df1ff58-58d7-454e-a43d-d1e5244fd0fd",
                    "object_modified": "2026-10-07T21:20:57.382Z"
                },
                {
                    "object_ref": "relationship--8e11c3ef-4ee3-4a91-868f-d0a1c10d538b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--8e29dea4-1176-4fd8-8c73-6f5bccc7ec5e",
                    "object_modified": "2026-09-25T18:41:44.451Z"
                },
                {
                    "object_ref": "relationship--8ecf5eac-7767-411b-b54a-b374ea51b9e9",
                    "object_modified": "2026-04-29T14:23:06.120Z"
                },
                {
                    "object_ref": "relationship--8ed7e323-578c-4a62-bf32-0bf2fefa872b",
                    "object_modified": "2026-04-29T14:23:06.120Z"
                },
                {
                    "object_ref": "relationship--8f76d408-be8a-478e-8a5a-aab1d1f96572",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8f7ccb2b-de2a-4a5c-9f1e-d5e58e69efa8",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8f7df0c0-9cc3-4322-847d-1f4ec35dfa65",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8f90363e-2825-4178-807f-9268a28760fa",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8fa6fe89-e704-4be4-a15b-50e188084aa3",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8fcecf74-36df-41ab-9476-539c9ac0b339",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--8fe2bc4c-e9f7-430d-84d5-e3d603141dcb",
                    "object_modified": "2026-04-29T14:23:06.121Z"
                },
                {
                    "object_ref": "relationship--9042b73d-5c10-4797-bace-71e49adeebdf",
                    "object_modified": "2026-04-29T14:23:06.122Z"
                },
                {
                    "object_ref": "relationship--9058043b-50b6-48de-b34b-5fb254fe471b",
                    "object_modified": "2026-09-26T05:11:40.254Z"
                },
                {
                    "object_ref": "relationship--90647f03-38a4-4364-a3af-53640a81360e",
                    "object_modified": "2026-07-31T21:05:26.009Z"
                },
                {
                    "object_ref": "relationship--90d4ef3f-f0d4-40ac-9f63-61242b757a32",
                    "object_modified": "2026-04-29T14:23:06.122Z"
                },
                {
                    "object_ref": "relationship--90d9c8e3-0250-4096-8d98-7ca1d324d654",
                    "object_modified": "2026-04-29T14:23:06.123Z"
                },
                {
                    "object_ref": "relationship--90de74d1-598a-4372-9d7a-ed2c872b4c42",
                    "object_modified": "2026-10-07T22:11:47.527Z"
                },
                {
                    "object_ref": "relationship--90e245ae-a785-4956-be9b-dc4da0b290c5",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--910bada1-c923-4009-a9ea-da257072f168",
                    "object_modified": "2026-04-29T14:23:06.123Z"
                },
                {
                    "object_ref": "relationship--9129c348-431e-45b4-8a7b-7bc71b47732b",
                    "object_modified": "2026-04-29T14:23:06.123Z"
                },
                {
                    "object_ref": "relationship--91501bcb-896f-4bda-9f97-196145646185",
                    "object_modified": "2026-04-29T14:23:06.123Z"
                },
                {
                    "object_ref": "relationship--917b1dc7-5fbd-47f4-addf-fa1dd869ccb5",
                    "object_modified": "2026-10-07T20:08:09.250Z"
                },
                {
                    "object_ref": "relationship--91f29477-2ff6-4dbf-bf68-c8825a938851",
                    "object_modified": "2026-04-29T14:23:06.124Z"
                },
                {
                    "object_ref": "relationship--928c6d15-e527-48a5-858a-ff04dc6ecf31",
                    "object_modified": "2026-10-07T21:40:50.271Z"
                },
                {
                    "object_ref": "relationship--92c8e2f2-0670-49a8-855c-4c5d1492fa36",
                    "object_modified": "2026-09-25T16:51:18.467Z"
                },
                {
                    "object_ref": "relationship--92d1fd4f-6cc7-4db5-82f8-f8caa5ff59f0",
                    "object_modified": "2026-04-29T14:23:06.125Z"
                },
                {
                    "object_ref": "relationship--9315cc99-8e64-4bdc-99b9-6c8ab9b1f5ce",
                    "object_modified": "2026-04-29T14:23:06.125Z"
                },
                {
                    "object_ref": "relationship--931e05ae-0fc9-4e37-9c88-063b80fd1d61",
                    "object_modified": "2026-04-29T14:23:06.126Z"
                },
                {
                    "object_ref": "relationship--93489277-7107-4bad-a9d1-2013ef471905",
                    "object_modified": "2026-04-29T14:23:06.126Z"
                },
                {
                    "object_ref": "relationship--938ff1d4-acce-4e4e-8a9c-be62799dff8e",
                    "object_modified": "2026-04-29T14:23:06.126Z"
                },
                {
                    "object_ref": "relationship--9397e373-3be0-4229-b390-fd5ed0482999",
                    "object_modified": "2026-04-29T14:23:06.126Z"
                },
                {
                    "object_ref": "relationship--93c336f2-7e7c-4c79-af16-faae03e66121",
                    "object_modified": "2026-04-29T14:23:06.126Z"
                },
                {
                    "object_ref": "relationship--93c52f94-839f-4093-b160-55af996c99c3",
                    "object_modified": "2026-10-07T21:52:50.978Z"
                },
                {
                    "object_ref": "relationship--943a9a5c-7826-451d-ac73-34353ea40595",
                    "object_modified": "2026-04-29T14:23:06.127Z"
                },
                {
                    "object_ref": "relationship--94654460-b115-4056-beb1-e982ed33437b",
                    "object_modified": "2026-04-29T14:23:06.127Z"
                },
                {
                    "object_ref": "relationship--9515f24c-1c33-4197-b9c9-b9992bc696ca",
                    "object_modified": "2026-04-29T14:23:06.128Z"
                },
                {
                    "object_ref": "relationship--9537d9c9-ba0d-42d9-b97d-3b28bfe265e6",
                    "object_modified": "2026-04-29T14:23:06.128Z"
                },
                {
                    "object_ref": "relationship--954fc7ef-7e8a-446c-82d1-9798d8c00fbe",
                    "object_modified": "2026-07-31T20:48:19.828Z"
                },
                {
                    "object_ref": "relationship--962128bd-13b9-48a6-a4c8-3f07104a962f",
                    "object_modified": "2026-04-29T14:23:06.130Z"
                },
                {
                    "object_ref": "relationship--966b59c0-8641-432c-84f7-b2a712004d74",
                    "object_modified": "2026-04-29T14:23:06.130Z"
                },
                {
                    "object_ref": "relationship--968830b7-ee80-4a6e-96a4-9fc70470e4a9",
                    "object_modified": "2026-04-29T14:23:06.130Z"
                },
                {
                    "object_ref": "relationship--968fd463-fec4-4b2d-b3c9-950d8471b9a8",
                    "object_modified": "2026-04-29T14:23:06.130Z"
                },
                {
                    "object_ref": "relationship--9700cbbe-4107-4c4f-b6df-32b9048e370a",
                    "object_modified": "2026-04-20T20:54:21.238Z"
                },
                {
                    "object_ref": "relationship--973f5884-a076-413e-ac96-f0bd01375fb6",
                    "object_modified": "2026-04-29T14:23:06.131Z"
                },
                {
                    "object_ref": "relationship--97756c8a-b702-472b-8d67-15464a73093e",
                    "object_modified": "2026-08-04T20:48:45.032Z"
                },
                {
                    "object_ref": "relationship--97c5b388-518a-46ec-b2b0-41bfa6a83204",
                    "object_modified": "2026-04-29T14:23:06.132Z"
                },
                {
                    "object_ref": "relationship--97e20860-29d9-4738-a9a8-6cc3e4db23f1",
                    "object_modified": "2026-04-29T14:23:06.132Z"
                },
                {
                    "object_ref": "relationship--97f42cef-bc2a-47c5-b408-8e38aab4030e",
                    "object_modified": "2026-04-29T14:23:06.132Z"
                },
                {
                    "object_ref": "relationship--98288d43-50ca-4720-a5e4-f76f07e9f7cd",
                    "object_modified": "2026-04-29T14:23:06.132Z"
                },
                {
                    "object_ref": "relationship--982d0b4f-274a-4738-9262-57fc80d468f9",
                    "object_modified": "2026-04-29T14:23:06.132Z"
                },
                {
                    "object_ref": "relationship--983de217-1ea6-483a-a273-ecf950706cd7",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--984992e3-0407-406a-b8dd-c114d8b2d9a2",
                    "object_modified": "2026-04-29T14:23:06.133Z"
                },
                {
                    "object_ref": "relationship--984d517f-56a1-4eb4-95e5-994eb9c6c3b5",
                    "object_modified": "2026-07-31T21:11:05.557Z"
                },
                {
                    "object_ref": "relationship--98567b03-7421-4761-8caa-cbea82d89fe3",
                    "object_modified": "2026-04-29T14:23:06.133Z"
                },
                {
                    "object_ref": "relationship--9897bb19-d5bb-4c43-9415-983ba5c5bbe5",
                    "object_modified": "2026-04-29T14:23:06.133Z"
                },
                {
                    "object_ref": "relationship--98d7d238-3473-4e3c-adc0-3c8d33341466",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--98e109ce-29d8-4711-91c1-a6322b20bd3a",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--98f1d575-a975-42ae-8b00-2c9e22d560d5",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--98f91f4f-050b-43b7-a033-589ec507913f",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--9902691c-aaf2-48a1-b1ca-cd6f652ae1c6",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--990f944f-190d-456d-b194-f5ecb17a0868",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--9951eb11-8140-420d-8e2d-56fbe0ff0134",
                    "object_modified": "2026-04-29T14:23:06.134Z"
                },
                {
                    "object_ref": "relationship--99d2eeab-8ace-41c9-b47d-4058dd906136",
                    "object_modified": "2026-04-29T14:23:06.135Z"
                },
                {
                    "object_ref": "relationship--99ec0a8e-4a4f-427c-89db-163e4b206021",
                    "object_modified": "2026-04-29T14:23:06.135Z"
                },
                {
                    "object_ref": "relationship--99f84b91-32a1-4ade-8de5-5d2a0359302f",
                    "object_modified": "2026-04-29T14:23:06.135Z"
                },
                {
                    "object_ref": "relationship--9a2291c2-9515-4343-ad47-380b5c6db29f",
                    "object_modified": "2026-10-07T20:19:02.720Z"
                },
                {
                    "object_ref": "relationship--9a44b2a8-9f4c-43df-9174-1cba6e165886",
                    "object_modified": "2026-04-29T14:23:06.135Z"
                },
                {
                    "object_ref": "relationship--9a55e351-d3b7-460a-9a9d-6714c00db5f0",
                    "object_modified": "2026-07-31T20:48:43.028Z"
                },
                {
                    "object_ref": "relationship--9a607f89-85b8-4fba-8eb7-7e4900ea693f",
                    "object_modified": "2026-09-03T20:31:27.572Z"
                },
                {
                    "object_ref": "relationship--9aacca46-bf65-4247-b14c-65359d1b47db",
                    "object_modified": "2026-04-29T14:23:06.136Z"
                },
                {
                    "object_ref": "relationship--9abf0914-2508-4717-9f1a-8f209c2d20a3",
                    "object_modified": "2026-04-29T14:23:06.136Z"
                },
                {
                    "object_ref": "relationship--9b0b3c25-d87c-452a-a2f9-241234410eb8",
                    "object_modified": "2026-04-29T14:23:06.136Z"
                },
                {
                    "object_ref": "relationship--9b412b1f-2dd0-4e7f-8364-f625181ba1db",
                    "object_modified": "2026-04-29T14:23:06.137Z"
                },
                {
                    "object_ref": "relationship--9b7bc0f3-c7cf-47e4-a3ed-0f91e01831ca",
                    "object_modified": "2026-04-29T14:23:06.137Z"
                },
                {
                    "object_ref": "relationship--9b802cf9-03e4-414f-af09-fc108e96839c",
                    "object_modified": "2026-04-29T14:23:06.137Z"
                },
                {
                    "object_ref": "relationship--9b825e77-2b18-4bc8-8e1d-5f645d570dca",
                    "object_modified": "2026-07-31T20:48:42.187Z"
                },
                {
                    "object_ref": "relationship--9ba6c904-d1bd-46dd-95fb-6da58333fa40",
                    "object_modified": "2026-04-29T14:23:06.137Z"
                },
                {
                    "object_ref": "relationship--9bb98efc-3712-4df3-a1a4-8dfefd2983fa",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--9c23121e-14bb-4382-b54d-2ea02a2815b5",
                    "object_modified": "2026-04-29T14:23:06.138Z"
                },
                {
                    "object_ref": "relationship--9ca97ea4-faf6-484c-bccf-311c282bed02",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9cca3120-c95e-4f5e-bc4b-0521ab5cc512",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9ce25235-ad56-4158-a392-31ef70b10c2a",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9cfee66a-96e2-4dd9-b046-19f3562b3112",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9d10209f-077c-4d25-87e9-c1ea423a528f",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9d463aef-aa70-4375-9ed3-4b0387ba70e6",
                    "object_modified": "2026-04-29T14:23:06.139Z"
                },
                {
                    "object_ref": "relationship--9d69d936-58a0-4453-8424-40fcc7bc2e1c",
                    "object_modified": "2026-04-29T14:23:06.140Z"
                },
                {
                    "object_ref": "relationship--9d6f9bba-dd79-4cb6-a0f3-1284e58a6236",
                    "object_modified": "2026-04-29T14:23:06.140Z"
                },
                {
                    "object_ref": "relationship--9db1ecfe-72eb-42da-a09e-746663a53854",
                    "object_modified": "2026-04-29T14:23:06.140Z"
                },
                {
                    "object_ref": "relationship--9e44709f-7068-4a2e-935b-44b309b76acd",
                    "object_modified": "2026-04-29T14:23:06.141Z"
                },
                {
                    "object_ref": "relationship--9e98d88c-4138-4d0e-8db0-cddf956ab500",
                    "object_modified": "2026-04-29T14:23:06.141Z"
                },
                {
                    "object_ref": "relationship--9f07c92a-78a0-438a-8cb2-01e2bddaeb42",
                    "object_modified": "2026-07-31T20:48:33.138Z"
                },
                {
                    "object_ref": "relationship--9f2926a2-596f-459e-827e-6fe2d4646efd",
                    "object_modified": "2026-04-29T14:23:06.142Z"
                },
                {
                    "object_ref": "relationship--9f2f9cba-b7fc-45cb-8e66-e2f8f99ebe35",
                    "object_modified": "2026-04-29T14:23:06.142Z"
                },
                {
                    "object_ref": "relationship--9f43126d-5f6c-42a9-9908-49175c27ead7",
                    "object_modified": "2026-07-31T20:48:33.153Z"
                },
                {
                    "object_ref": "relationship--9f54f1ed-0390-4d21-9929-0bd57e821a68",
                    "object_modified": "2026-09-25T20:09:20.222Z"
                },
                {
                    "object_ref": "relationship--9f5e8e35-663e-477b-86ab-75dfc9695ed8",
                    "object_modified": "2026-09-25T16:50:47.761Z"
                },
                {
                    "object_ref": "relationship--9fa6797f-f2cb-4b93-b8eb-f40936e967f3",
                    "object_modified": "2026-04-29T14:23:06.143Z"
                },
                {
                    "object_ref": "relationship--9ffbf620-8e1f-4542-a271-9a3692db9a47",
                    "object_modified": "2026-04-29T14:23:06.143Z"
                },
                {
                    "object_ref": "relationship--a0151b8f-30ee-49da-8365-17f34eab0825",
                    "object_modified": "2026-09-03T20:30:36.625Z"
                },
                {
                    "object_ref": "relationship--a016cddb-5cd8-485b-a207-9860e9ec0a02",
                    "object_modified": "2026-04-29T14:23:06.143Z"
                },
                {
                    "object_ref": "relationship--a04169ed-c16b-466b-80ef-22a11067f475",
                    "object_modified": "2026-04-29T14:23:06.143Z"
                },
                {
                    "object_ref": "relationship--a05f4a7a-eebb-463a-97e6-1088b94fa78b",
                    "object_modified": "2026-04-29T14:23:06.144Z"
                },
                {
                    "object_ref": "relationship--a071df12-8c07-40ee-91be-c2cbba753e39",
                    "object_modified": "2026-10-07T19:38:07.364Z"
                },
                {
                    "object_ref": "relationship--a07f265e-e04e-496c-b1bd-65f57b85a491",
                    "object_modified": "2026-04-29T14:23:06.144Z"
                },
                {
                    "object_ref": "relationship--a08d85dd-a8b3-4848-94aa-941c43b6d8f2",
                    "object_modified": "2026-04-29T14:23:06.144Z"
                },
                {
                    "object_ref": "relationship--a1383f2a-2ee2-47df-a661-8904a7535e0c",
                    "object_modified": "2026-04-29T14:23:06.144Z"
                },
                {
                    "object_ref": "relationship--a15d718f-af30-4745-a837-887ba8f48727",
                    "object_modified": "2026-04-29T14:23:06.145Z"
                },
                {
                    "object_ref": "relationship--a1cbbdb5-30ad-4139-9784-e5a134f8d405",
                    "object_modified": "2026-04-29T14:23:06.145Z"
                },
                {
                    "object_ref": "relationship--a1d2df14-6f44-44ac-99c2-3e3f55f53476",
                    "object_modified": "2026-04-29T14:23:06.145Z"
                },
                {
                    "object_ref": "relationship--a1d99bbc-8d7c-4263-a909-95a9507b43c3",
                    "object_modified": "2026-09-03T20:28:49.013Z"
                },
                {
                    "object_ref": "relationship--a1e6b6f0-b13c-48a0-b62d-12dfb80112ad",
                    "object_modified": "2026-04-29T14:23:06.145Z"
                },
                {
                    "object_ref": "relationship--a20bde51-3ed9-4306-92cd-f4f12d3aa8aa",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--a221bbb3-5f4f-4879-ae1d-37e8d3022039",
                    "object_modified": "2026-04-29T14:23:06.146Z"
                },
                {
                    "object_ref": "relationship--a22fabd2-836e-4141-9219-c76cc10138ec",
                    "object_modified": "2026-04-29T14:23:06.146Z"
                },
                {
                    "object_ref": "relationship--a23297f1-58b9-48f4-8289-e81c34d9a522",
                    "object_modified": "2026-04-29T14:23:06.146Z"
                },
                {
                    "object_ref": "relationship--a23aefa6-15f5-481c-ac3d-09b8e4b3003b",
                    "object_modified": "2026-04-29T14:23:06.146Z"
                },
                {
                    "object_ref": "relationship--a287bc05-20cb-4476-ba1f-15bfde6e601d",
                    "object_modified": "2026-04-29T14:23:06.146Z"
                },
                {
                    "object_ref": "relationship--a2f0b9ba-2d6e-43a5-adca-3ec42dba5ce9",
                    "object_modified": "2026-04-29T14:23:06.147Z"
                },
                {
                    "object_ref": "relationship--a31d48c1-785e-4587-a102-d910054143fb",
                    "object_modified": "2026-04-29T14:23:06.147Z"
                },
                {
                    "object_ref": "relationship--a3447ec8-3224-4485-9324-cdc77231aaa5",
                    "object_modified": "2026-07-31T20:48:56.361Z"
                },
                {
                    "object_ref": "relationship--a350a6c6-c95c-401e-9437-cb275776cc00",
                    "object_modified": "2026-10-07T21:45:25.687Z"
                },
                {
                    "object_ref": "relationship--a36492bd-175a-4c39-9c56-32d06660dd05",
                    "object_modified": "2026-04-29T14:23:06.147Z"
                },
                {
                    "object_ref": "relationship--a3971be9-7bef-4663-b6c3-3cffc418f76b",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a3c8ede9-78d4-49c0-b1f2-16257c940189",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a3df8609-d9c4-4ef0-9a58-8d7155fba4f7",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a3f1ae82-b279-41ec-828e-40e969c7b165",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a3f258ea-6d4d-4b0e-8ff2-b91f49dfd4d7",
                    "object_modified": "2026-09-03T20:30:36.637Z"
                },
                {
                    "object_ref": "relationship--a3fb7c3c-7064-43d2-849c-2a5893583de9",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a43e516e-603f-4863-a315-17c998b2f6f8",
                    "object_modified": "2026-04-29T14:23:06.148Z"
                },
                {
                    "object_ref": "relationship--a466d5b4-39f0-48c1-9a19-f006dc4cb0ac",
                    "object_modified": "2026-04-29T14:23:06.149Z"
                },
                {
                    "object_ref": "relationship--a48f58bc-4119-4399-b7d1-7e44b867399d",
                    "object_modified": "2026-04-29T14:23:06.149Z"
                },
                {
                    "object_ref": "relationship--a4c64fbc-bac4-44b8-ba52-8fcfa3f674e5",
                    "object_modified": "2026-04-29T14:23:06.149Z"
                },
                {
                    "object_ref": "relationship--a4c81fe6-1ad9-4bba-a415-a3c099eaa2be",
                    "object_modified": "2026-04-29T14:23:06.149Z"
                },
                {
                    "object_ref": "relationship--a4da9bf3-d9da-4bc3-bb59-a5d17fa53b20",
                    "object_modified": "2026-07-31T20:48:55.198Z"
                },
                {
                    "object_ref": "relationship--a4e9cd0c-75aa-47ec-9fdc-ad9dd8935af2",
                    "object_modified": "2026-04-29T14:23:06.149Z"
                },
                {
                    "object_ref": "relationship--a57b233b-6613-4f78-aa48-e85518aaa7cf",
                    "object_modified": "2026-08-04T20:48:45.059Z"
                },
                {
                    "object_ref": "relationship--a5b4b91c-0f68-4b88-bd6f-ab226ae9b5f0",
                    "object_modified": "2026-04-29T14:23:06.151Z"
                },
                {
                    "object_ref": "relationship--a5f6d393-5032-4ed1-ab78-04755582c1ff",
                    "object_modified": "2026-09-25T19:17:17.559Z"
                },
                {
                    "object_ref": "relationship--a61e5450-cfb0-46b4-9726-0e28c4e97a6b",
                    "object_modified": "2026-09-26T05:31:50.224Z"
                },
                {
                    "object_ref": "relationship--a61fa979-f701-4dbe-b040-397b152ac14f",
                    "object_modified": "2026-04-29T14:23:06.151Z"
                },
                {
                    "object_ref": "relationship--a6277ff6-9cdf-484f-a902-3f9442039905",
                    "object_modified": "2026-04-29T14:23:06.151Z"
                },
                {
                    "object_ref": "relationship--a6479493-6154-408f-90df-9d2f3ae352d1",
                    "object_modified": "2026-07-31T21:05:26.096Z"
                },
                {
                    "object_ref": "relationship--a6519c11-e9d4-4b6f-8d92-8efaa2144c28",
                    "object_modified": "2026-04-29T14:23:06.152Z"
                },
                {
                    "object_ref": "relationship--a6bdcd4d-f3e8-42bb-b74e-993cb04de17e",
                    "object_modified": "2026-10-07T20:29:20.640Z"
                },
                {
                    "object_ref": "relationship--a6d8b66d-fc10-404f-b0ae-e8c66506b818",
                    "object_modified": "2026-04-29T14:23:06.152Z"
                },
                {
                    "object_ref": "relationship--a6e404c9-7b12-4403-8f2a-2815b8b87372",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--a6e9bbe1-3e59-45c0-987a-b5354d602dc7",
                    "object_modified": "2026-04-29T14:23:06.152Z"
                },
                {
                    "object_ref": "relationship--a6ebd61b-7845-4694-9860-2e8998f2841f",
                    "object_modified": "2026-04-29T14:23:06.152Z"
                },
                {
                    "object_ref": "relationship--a717ccc7-0fe6-4a83-951f-5a89037ed927",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a72c212f-6d4f-4c5d-873d-afa42021024c",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a7333752-af0d-42e0-88e5-7c1134e6e6c8",
                    "object_modified": "2026-04-20T20:54:25.517Z"
                },
                {
                    "object_ref": "relationship--a7649bd4-5b10-4d55-adaf-228e31472dff",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a78e727c-8e42-448c-beb4-463804e18be0",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a78fc081-051a-45ca-91c2-c3f29325cbf2",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a7a2790e-d5ba-4a46-bde3-c698c6ae52ac",
                    "object_modified": "2026-04-29T14:23:06.153Z"
                },
                {
                    "object_ref": "relationship--a7caa7f2-cfb9-4fc9-ae8d-49349b6c260f",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a7fbe555-a61b-4b93-bfb2-8e0dd0d6323e",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a846dbe5-9ef3-4fb6-93d5-f764671a75c8",
                    "object_modified": "2026-07-31T20:48:33.174Z"
                },
                {
                    "object_ref": "relationship--a847aa03-ea56-47d1-8f4e-f9e0dd9707a0",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a849d434-a070-43ff-a73f-49ff616ad865",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a84dd2f5-d4f4-44c1-ba51-4804f40576e1",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a8563939-14f9-4790-a8bb-6e984e3ad7ac",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a86cee0a-dc49-4c95-b5dc-37405337490b",
                    "object_modified": "2026-04-29T14:23:06.154Z"
                },
                {
                    "object_ref": "relationship--a873cbaa-04c1-4402-a8d1-683cc7b1ac85",
                    "object_modified": "2026-04-29T14:23:06.155Z"
                },
                {
                    "object_ref": "relationship--a8f136ed-4ab7-4dbc-ba22-db57ace5ed6e",
                    "object_modified": "2026-04-29T14:23:06.155Z"
                },
                {
                    "object_ref": "relationship--a90c8f61-75af-4da2-8813-ad60c5493283",
                    "object_modified": "2026-10-07T21:45:50.020Z"
                },
                {
                    "object_ref": "relationship--a91002fe-21b2-4417-9c23-af712a7a035c",
                    "object_modified": "2026-04-29T14:23:06.155Z"
                },
                {
                    "object_ref": "relationship--a91295dc-b381-4dc9-9384-9f9949066778",
                    "object_modified": "2026-04-29T14:23:06.155Z"
                },
                {
                    "object_ref": "relationship--a918d944-e50b-4b2c-9b77-6e28afe68607",
                    "object_modified": "2026-04-29T14:23:06.155Z"
                },
                {
                    "object_ref": "relationship--a93ba793-24dd-47dd-b32c-4c3016124c90",
                    "object_modified": "2026-09-03T20:28:49.026Z"
                },
                {
                    "object_ref": "relationship--a946c9b1-5b89-44c9-b617-3412ffda34b9",
                    "object_modified": "2026-04-29T14:23:06.156Z"
                },
                {
                    "object_ref": "relationship--a97c2f8c-c7c9-423f-8679-a58c11f8d409",
                    "object_modified": "2026-04-29T14:23:06.156Z"
                },
                {
                    "object_ref": "relationship--a99cb0b8-4ac0-4712-850a-3aac16f87520",
                    "object_modified": "2026-04-29T14:23:06.156Z"
                },
                {
                    "object_ref": "relationship--a9dd70c2-2f54-4b19-85df-df11cbeb0dbd",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--aa444531-fa05-4bb4-a23e-8ac133781131",
                    "object_modified": "2026-04-29T14:23:06.157Z"
                },
                {
                    "object_ref": "relationship--aa7a0f45-e027-4d79-8413-5d807f44c1ba",
                    "object_modified": "2026-04-29T14:23:06.157Z"
                },
                {
                    "object_ref": "relationship--aabf71ab-4121-4e3e-888d-cc16d2133846",
                    "object_modified": "2026-07-31T20:48:17.861Z"
                },
                {
                    "object_ref": "relationship--ab306654-2abb-4983-8d30-df4058adb06c",
                    "object_modified": "2026-10-07T19:33:45.869Z"
                },
                {
                    "object_ref": "relationship--ab60fe4a-5860-410a-8bca-2cdbea95e5f8",
                    "object_modified": "2026-04-29T14:23:06.158Z"
                },
                {
                    "object_ref": "relationship--ab844cd2-0f56-44f9-9838-cd5f04d75f3e",
                    "object_modified": "2026-04-29T14:23:06.158Z"
                },
                {
                    "object_ref": "relationship--ab85bff5-7f2a-400c-a86e-b63747200e1f",
                    "object_modified": "2026-09-26T05:12:23.178Z"
                },
                {
                    "object_ref": "relationship--ab8bf0a3-0eef-4364-a3f9-f6ab6222afed",
                    "object_modified": "2026-04-29T14:23:06.158Z"
                },
                {
                    "object_ref": "relationship--ab8e129c-5411-4784-9194-068fa915da23",
                    "object_modified": "2026-04-29T14:23:06.158Z"
                },
                {
                    "object_ref": "relationship--abce8e63-b622-441b-9b79-1fdd95da8cff",
                    "object_modified": "2026-09-26T05:07:29.132Z"
                },
                {
                    "object_ref": "relationship--ac1e880f-cc28-4344-91f3-6decd83975c4",
                    "object_modified": "2026-10-01T14:32:34.330Z"
                },
                {
                    "object_ref": "relationship--ac63d227-ff8a-43b8-81ef-ec4c046c4291",
                    "object_modified": "2026-04-29T14:23:06.160Z"
                },
                {
                    "object_ref": "relationship--ac7a74a9-7e1d-49d2-b1d8-0f0712fd578f",
                    "object_modified": "2026-04-29T14:23:06.160Z"
                },
                {
                    "object_ref": "relationship--ac8d2d28-5fdc-44d6-9e5a-8e5560b3f91f",
                    "object_modified": "2026-04-29T14:23:06.160Z"
                },
                {
                    "object_ref": "relationship--acb4e9f0-0c1a-4c34-a88c-9125f0bd453a",
                    "object_modified": "2026-09-03T20:28:49.042Z"
                },
                {
                    "object_ref": "relationship--acc06595-994a-469b-972e-c71ab3298dde",
                    "object_modified": "2026-09-26T05:08:44.138Z"
                },
                {
                    "object_ref": "relationship--acc646be-70db-48c0-9504-25ad122ddb40",
                    "object_modified": "2026-04-29T14:23:06.160Z"
                },
                {
                    "object_ref": "relationship--acd320fb-8c30-48d4-8ca0-c5379e0998fc",
                    "object_modified": "2026-04-29T14:23:06.160Z"
                },
                {
                    "object_ref": "relationship--ad2ed5dc-d683-4b0e-b1e2-50b2e61ffd11",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--ad3774f0-d286-4315-95db-a3a78752ef3b",
                    "object_modified": "2026-04-29T14:23:06.161Z"
                },
                {
                    "object_ref": "relationship--ad7770c3-fe24-4285-9ce2-1616a1061472",
                    "object_modified": "2026-07-31T20:48:31.008Z"
                },
                {
                    "object_ref": "relationship--ad7fd147-066e-4ed5-aa9d-7b2f1771150d",
                    "object_modified": "2026-04-29T14:23:06.161Z"
                },
                {
                    "object_ref": "relationship--ad8ca360-621d-4286-b092-695c18df73df",
                    "object_modified": "2026-10-07T19:38:48.787Z"
                },
                {
                    "object_ref": "relationship--adb41ca8-7d2a-4025-b673-db44c9e1f16b",
                    "object_modified": "2026-04-29T14:23:06.161Z"
                },
                {
                    "object_ref": "relationship--adc6a1fa-c265-481f-8cde-f28a30873682",
                    "object_modified": "2026-04-29T14:23:06.161Z"
                },
                {
                    "object_ref": "relationship--ade12d27-13bb-4ebf-be08-7039cf699682",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--adf2072c-0341-4fc2-9d25-495b4af864e9",
                    "object_modified": "2026-07-31T20:48:16.217Z"
                },
                {
                    "object_ref": "relationship--adf230b9-b622-473e-b7f4-6ea2dd13ab43",
                    "object_modified": "2026-07-31T20:48:14.241Z"
                },
                {
                    "object_ref": "relationship--ae0b459d-535d-4895-ac9f-6ec0518afe00",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae10e97a-90ac-498b-8601-01081dc4af8b",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae1e5c1a-8f2f-4a5a-a262-3d485c20e7a0",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae20022f-25b5-4eff-8775-53f1e0ad91b8",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae4e86c6-4bbb-4aba-80fc-c20a8f3d63dc",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae7487f1-a2d0-443d-b418-cd726c5ac15f",
                    "object_modified": "2026-04-29T14:23:06.162Z"
                },
                {
                    "object_ref": "relationship--ae7ed6d8-65cc-45a0-82c3-c28e5630bf7c",
                    "object_modified": "2026-07-31T20:48:16.225Z"
                },
                {
                    "object_ref": "relationship--aec4cb16-bee9-410e-bb74-e3fa70cacf6a",
                    "object_modified": "2026-04-29T14:23:06.163Z"
                },
                {
                    "object_ref": "relationship--af20f409-05ed-42c3-ae3e-09b047b84875",
                    "object_modified": "2026-04-29T14:23:06.163Z"
                },
                {
                    "object_ref": "relationship--af211aeb-17bd-495d-85c5-0790c1197e77",
                    "object_modified": "2026-10-07T20:32:54.177Z"
                },
                {
                    "object_ref": "relationship--af374cf3-b440-4783-8e1b-243a8dbdeaf4",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--af453639-85a4-4dcc-8f6b-b9dbce1a45e4",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--af595409-2976-4c01-bfbe-8d9c88f2d697",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--af5a7b69-9519-436e-bb58-049b08d82809",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--af5c41cb-063d-42a9-ad54-833bd65477d0",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--af802091-fee7-4d15-a845-fb4ee3c26d6d",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--af861c3e-966c-49aa-86c4-a76102977d16",
                    "object_modified": "2026-04-29T14:23:06.164Z"
                },
                {
                    "object_ref": "relationship--afb0b60e-e604-4b96-abb9-57fdce4e5108",
                    "object_modified": "2026-04-29T14:23:06.165Z"
                },
                {
                    "object_ref": "relationship--afd63145-6033-49e4-ad43-d0b35fa5ed88",
                    "object_modified": "2026-04-29T14:23:06.165Z"
                },
                {
                    "object_ref": "relationship--b050dc4e-4d1c-442a-9824-d7bcb37181f4",
                    "object_modified": "2026-04-29T14:23:06.166Z"
                },
                {
                    "object_ref": "relationship--b05d678b-4d87-4261-9366-f8b757a77661",
                    "object_modified": "2026-07-31T20:48:14.250Z"
                },
                {
                    "object_ref": "relationship--b0831dd8-64c9-42a8-bf2f-755bdffaca59",
                    "object_modified": "2026-09-03T20:28:49.054Z"
                },
                {
                    "object_ref": "relationship--b0945f9b-5608-472e-ad70-7b42c3e062a1",
                    "object_modified": "2026-04-29T14:23:06.166Z"
                },
                {
                    "object_ref": "relationship--b13417ea-d8da-497f-818f-d2d90562039a",
                    "object_modified": "2026-09-03T20:31:27.590Z"
                },
                {
                    "object_ref": "relationship--b1768154-221c-48be-ab2b-549ec1eddafb",
                    "object_modified": "2026-04-29T14:23:06.167Z"
                },
                {
                    "object_ref": "relationship--b1921480-8499-46a9-8396-2a2d747c5861",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b1c35486-c714-4517-9f59-742765773fa3",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b1d993d5-9e7e-4043-a651-07c7b5ad5a6b",
                    "object_modified": "2026-09-03T20:31:27.602Z"
                },
                {
                    "object_ref": "relationship--b217aaf1-0fe7-43cc-85ad-45b252651e2d",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b21e0340-976d-44b2-94ae-f777199993c6",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b22637e7-f58c-4c7e-9d76-4b3ee97fa14b",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b22c6faf-0046-4f89-8c5a-4f5ca44b638d",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b252a076-6d4e-49f5-95ac-16264ef05b1d",
                    "object_modified": "2026-04-29T14:23:06.168Z"
                },
                {
                    "object_ref": "relationship--b270a54c-2a59-46a1-a0b1-4e626bba0b25",
                    "object_modified": "2026-10-07T17:44:24.901Z"
                },
                {
                    "object_ref": "relationship--b2823439-efbd-4f91-9a7f-753d40004bc8",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--b289c971-3fb7-4c3c-b3d6-cf2702b9384a",
                    "object_modified": "2026-09-03T20:28:49.066Z"
                },
                {
                    "object_ref": "relationship--b2b871bc-18fb-46ad-a459-9d3ef06d25ae",
                    "object_modified": "2026-10-07T20:19:39.141Z"
                },
                {
                    "object_ref": "relationship--b2c3e6df-3e82-4b82-bb62-ca219dfdb934",
                    "object_modified": "2026-04-29T14:23:06.169Z"
                },
                {
                    "object_ref": "relationship--b2defaaf-625d-416e-8a9d-8be6d89bacdc",
                    "object_modified": "2026-04-29T14:23:06.169Z"
                },
                {
                    "object_ref": "relationship--b2e10e48-8bd9-472a-9c6f-1d38650e8df1",
                    "object_modified": "2026-04-29T14:23:06.169Z"
                },
                {
                    "object_ref": "relationship--b2e8914a-91bc-42df-8b64-22e5365ede6f",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b33f2abc-a218-425b-9a90-b75445b7e142",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b340e488-cae9-4c72-a704-ecb5ce7d9348",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--b343e131-e448-46c6-815b-b86e4bd6d638",
                    "object_modified": "2026-07-31T20:48:42.205Z"
                },
                {
                    "object_ref": "relationship--b3450c17-37c7-4ae1-be7a-21ed8680a0f7",
                    "object_modified": "2026-09-25T20:13:07.083Z"
                },
                {
                    "object_ref": "relationship--b346eec8-de90-407c-b665-387086bb4553",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b349ef5f-4a05-4eef-afe4-1543b8c832fa",
                    "object_modified": "2026-07-31T20:48:33.197Z"
                },
                {
                    "object_ref": "relationship--b363cbbb-679c-47e0-8ad0-af98ebf51e60",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b36d4c7e-2d4e-40ae-ae56-55c94adaf760",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b37844c1-0338-44f6-9116-48fa0f079913",
                    "object_modified": "2026-04-29T14:23:06.170Z"
                },
                {
                    "object_ref": "relationship--b3862aa6-7bd0-46a4-83b6-bb687bb7caa6",
                    "object_modified": "2026-07-31T20:48:42.212Z"
                },
                {
                    "object_ref": "relationship--b3aab26c-09c6-4264-af2a-5df260d3d8e2",
                    "object_modified": "2026-04-29T14:23:06.171Z"
                },
                {
                    "object_ref": "relationship--b3b24837-83ed-46c5-ba80-66a832c7072e",
                    "object_modified": "2026-04-29T14:23:06.171Z"
                },
                {
                    "object_ref": "relationship--b3b289bf-da9d-40b2-bedd-ca1b65271825",
                    "object_modified": "2026-04-29T14:23:06.171Z"
                },
                {
                    "object_ref": "relationship--b3f2990b-855e-49f3-b657-6b24118b2d19",
                    "object_modified": "2026-04-29T14:23:06.171Z"
                },
                {
                    "object_ref": "relationship--b3f29beb-4a3d-48c6-93ac-136646236a1a",
                    "object_modified": "2026-09-26T03:33:16.431Z"
                },
                {
                    "object_ref": "relationship--b3f2dffc-b79d-4de0-85eb-2d3238a4f36b",
                    "object_modified": "2026-04-20T20:54:21.776Z"
                },
                {
                    "object_ref": "relationship--b411f748-a1e9-40c6-8eb3-72f2de4dab08",
                    "object_modified": "2026-04-29T14:23:06.171Z"
                },
                {
                    "object_ref": "relationship--b4407f32-7f6c-4efa-861d-92f6cc116b0b",
                    "object_modified": "2026-10-07T20:08:35.968Z"
                },
                {
                    "object_ref": "relationship--b452a076-6d4e-49f5-95ac-16264ef05b1d",
                    "object_modified": "2026-04-29T14:23:06.172Z"
                },
                {
                    "object_ref": "relationship--b47dbc50-fd8f-4e5b-bb3d-e93b68bf5497",
                    "object_modified": "2026-04-29T14:23:06.172Z"
                },
                {
                    "object_ref": "relationship--b48a9fea-26a5-473c-9a5d-fcc3531e1fd3",
                    "object_modified": "2026-04-29T14:23:06.172Z"
                },
                {
                    "object_ref": "relationship--b4efcbe0-ffe3-4d9a-8dba-570e68494af1",
                    "object_modified": "2026-07-31T20:48:16.233Z"
                },
                {
                    "object_ref": "relationship--b58d2485-55f4-45ee-b2e1-6e067ae8d81b",
                    "object_modified": "2026-04-29T14:23:06.173Z"
                },
                {
                    "object_ref": "relationship--b58f623d-c61f-46e8-b356-09af226ba9ad",
                    "object_modified": "2026-04-29T14:23:06.173Z"
                },
                {
                    "object_ref": "relationship--b59a96e4-bd70-4459-9609-66563bccd9c3",
                    "object_modified": "2026-04-29T14:23:06.173Z"
                },
                {
                    "object_ref": "relationship--b5aa325c-4897-4e57-acdc-3c0df05b442e",
                    "object_modified": "2026-10-07T21:21:59.466Z"
                },
                {
                    "object_ref": "relationship--b5ab26e2-eb90-4f19-b35a-b8a0a5438961",
                    "object_modified": "2026-04-29T14:23:06.173Z"
                },
                {
                    "object_ref": "relationship--b5bb5ec3-aa3c-4734-8425-4be80c5658a9",
                    "object_modified": "2026-04-29T14:23:06.173Z"
                },
                {
                    "object_ref": "relationship--b5e52859-8dab-4e7e-af70-bb38c6993c98",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b628d878-4f35-4580-8d42-26984d13821e",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b6309476-8268-4c47-920b-8a556cd8ae4c",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b6483471-f9b5-43f1-8da3-6b69e180d46d",
                    "object_modified": "2026-10-07T21:41:16.628Z"
                },
                {
                    "object_ref": "relationship--b69905bd-6865-4092-9543-47bd9ae318ec",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b69f31c3-6c12-4b81-8e74-9c58ea635fa4",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b6a51a26-94fd-419f-b0c1-cc61e02e1475",
                    "object_modified": "2026-04-29T14:23:06.174Z"
                },
                {
                    "object_ref": "relationship--b6f48e41-f7a9-45ca-b445-9e262dd307a2",
                    "object_modified": "2026-04-29T14:23:06.175Z"
                },
                {
                    "object_ref": "relationship--b7052528-c465-403a-8a2a-8b1e69fc771a",
                    "object_modified": "2026-10-07T21:44:52.785Z"
                },
                {
                    "object_ref": "relationship--b720b42c-5eba-4164-9c3d-8b4eabde4716",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--b7284360-0d80-45bb-8486-263ae8f8fa63",
                    "object_modified": "2026-04-29T14:23:06.175Z"
                },
                {
                    "object_ref": "relationship--b72b7dfd-f134-4324-84b8-52ff13fc6b5c",
                    "object_modified": "2026-04-29T14:23:06.175Z"
                },
                {
                    "object_ref": "relationship--b7344dfb-621b-4558-ab22-6c1f256ee746",
                    "object_modified": "2026-04-29T14:23:06.175Z"
                },
                {
                    "object_ref": "relationship--b774fcb4-43bf-4ff1-98c6-0a94838eacc2",
                    "object_modified": "2026-04-29T14:23:06.176Z"
                },
                {
                    "object_ref": "relationship--b7943cdb-1a6b-46cf-aebe-8282fd86c357",
                    "object_modified": "2026-04-29T14:23:06.176Z"
                },
                {
                    "object_ref": "relationship--b7a32080-49ce-432f-8b75-abd944be4e82",
                    "object_modified": "2026-04-29T14:23:06.176Z"
                },
                {
                    "object_ref": "relationship--b7a9bff5-2e15-4d3d-ac88-84af1239a586",
                    "object_modified": "2026-04-29T14:23:06.176Z"
                },
                {
                    "object_ref": "relationship--b7f23af2-e948-4531-af56-1a1b4d03702f",
                    "object_modified": "2026-04-29T14:23:06.176Z"
                },
                {
                    "object_ref": "relationship--b80545f9-cf00-4ef1-8c45-e325d9447f98",
                    "object_modified": "2026-10-07T19:39:05.181Z"
                },
                {
                    "object_ref": "relationship--b84e1473-f370-42ad-ac3b-7caf3c8cd00e",
                    "object_modified": "2026-09-03T20:30:36.654Z"
                },
                {
                    "object_ref": "relationship--b8c33196-8fc2-4855-b764-cd49554f0223",
                    "object_modified": "2026-04-29T14:23:06.177Z"
                },
                {
                    "object_ref": "relationship--b8ce3f0c-7c11-4846-b567-a5d4233b0e6e",
                    "object_modified": "2026-04-29T14:23:06.177Z"
                },
                {
                    "object_ref": "relationship--b8d6e550-18fe-49ad-9964-7802bbe0cb58",
                    "object_modified": "2026-04-29T14:23:06.177Z"
                },
                {
                    "object_ref": "relationship--b8e71df0-20c4-42b0-8d80-68e93fc084c2",
                    "object_modified": "2026-07-31T20:48:19.928Z"
                },
                {
                    "object_ref": "relationship--b8edcf0a-ec53-4203-b3ad-2cc734a1f1dd",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b8f6d6a8-e668-4596-8ec2-41c5d1bd211d",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b9608e90-25f7-4a0a-b621-5512827ac169",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b9632b4d-43c3-4bfa-88e0-629245acb8eb",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b9a1e946-4ece-48f3-949c-e1c2d39136fe",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b9b45f7a-742f-4b72-bdee-577ceb539499",
                    "object_modified": "2026-04-29T14:23:06.178Z"
                },
                {
                    "object_ref": "relationship--b9e82422-b072-494f-99c1-fcab07b90133",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba010007-6dde-4c9d-8452-69527cd1c2ba",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba24af7b-dd2f-4c21-9ec5-27758b88da9b",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba394cbc-461d-44cc-8fa5-92f11a5c8e6b",
                    "object_modified": "2026-07-31T20:48:55.469Z"
                },
                {
                    "object_ref": "relationship--ba496af3-2d99-4c2b-8ce0-20388f5d632c",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba49c0ad-293e-46c3-a0f9-30a25dba415a",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba943eeb-5673-44b5-acbf-1cddc2fefb1a",
                    "object_modified": "2026-04-29T14:23:06.179Z"
                },
                {
                    "object_ref": "relationship--ba9ebebf-d5dd-4a5c-b44f-a07cc3ccac8b",
                    "object_modified": "2026-08-04T20:48:45.100Z"
                },
                {
                    "object_ref": "relationship--bac1f95c-87bf-4939-bc1a-7727aad738f7",
                    "object_modified": "2026-04-29T14:23:06.180Z"
                },
                {
                    "object_ref": "relationship--bad056aa-b8a6-4c4c-9bfa-bcc518872341",
                    "object_modified": "2026-04-29T14:23:06.180Z"
                },
                {
                    "object_ref": "relationship--badf753a-349e-4a3c-a425-b12efd65d856",
                    "object_modified": "2026-04-20T20:58:44.598Z"
                },
                {
                    "object_ref": "relationship--baf4bd30-4213-43c3-b70c-54418e734caf",
                    "object_modified": "2026-04-29T14:23:06.180Z"
                },
                {
                    "object_ref": "relationship--baf7daf3-2116-4051-91b5-f82e146167d0",
                    "object_modified": "2026-04-29T14:23:06.181Z"
                },
                {
                    "object_ref": "relationship--bb3938a6-85ec-4f34-8bcd-6051de7e9259",
                    "object_modified": "2026-04-29T14:23:06.181Z"
                },
                {
                    "object_ref": "relationship--bbbbad6d-fc22-4f87-92e6-445f05e08e39",
                    "object_modified": "2026-04-29T14:23:06.181Z"
                },
                {
                    "object_ref": "relationship--bbeb2eae-7da2-4477-ad8e-8c67b00c53bc",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc0e4ff7-ed61-41c0-84ca-66210241c9ce",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc3744d6-9275-4d91-8888-16d5f4d5187b",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc383819-2e40-49b4-bea9-95eb5d418877",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc3a0b1f-f0ec-466f-8cad-8f47b07764c9",
                    "object_modified": "2026-09-03T20:28:49.080Z"
                },
                {
                    "object_ref": "relationship--bc475267-c604-4f40-8876-ec4b375025f1",
                    "object_modified": "2026-09-25T18:47:01.224Z"
                },
                {
                    "object_ref": "relationship--bc51e6c7-6211-4124-874d-4a5aea2efce0",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc6f2a51-9307-4268-a6d6-51c02ae893fd",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bc74ff8f-d5fa-40fb-8c0b-f16af3ff36e3",
                    "object_modified": "2026-04-29T14:23:06.182Z"
                },
                {
                    "object_ref": "relationship--bcece7ce-91b5-40b3-b87a-25cab3600e5c",
                    "object_modified": "2026-09-03T20:30:36.666Z"
                },
                {
                    "object_ref": "relationship--bd16f422-4869-49f8-9b86-16220e857c9b",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bd2ee84f-349c-4a89-b224-d48269bd9b0a",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bd639f3c-0887-49a6-9274-37e1e2d24808",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bd7bd67c-f636-481f-a301-7e8da69b5aef",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bd821f38-4517-4461-9bc9-d084ccd2721e",
                    "object_modified": "2026-10-07T21:41:40.320Z"
                },
                {
                    "object_ref": "relationship--bd869385-5778-4303-8993-cc6412d12303",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bda03e8d-5e06-4470-b786-11b11c7c97c7",
                    "object_modified": "2026-04-29T14:23:06.184Z"
                },
                {
                    "object_ref": "relationship--bdae915d-64f8-4944-949c-59a4d35b70c5",
                    "object_modified": "2026-07-31T20:48:19.936Z"
                },
                {
                    "object_ref": "relationship--bde941c6-2ca0-4f94-9336-027e7eee15a1",
                    "object_modified": "2026-09-03T20:30:36.679Z"
                },
                {
                    "object_ref": "relationship--be0f7d83-2441-4259-b411-46e0d10566b1",
                    "object_modified": "2026-04-29T14:23:06.185Z"
                },
                {
                    "object_ref": "relationship--be532c78-daf5-431b-adae-ab11af395513",
                    "object_modified": "2026-04-29T14:23:06.185Z"
                },
                {
                    "object_ref": "relationship--be950e87-80ac-49ea-810a-553c7f72151b",
                    "object_modified": "2026-04-29T14:23:06.186Z"
                },
                {
                    "object_ref": "relationship--beb0c5be-2b81-4d8d-9d9f-35e496be4e0f",
                    "object_modified": "2026-04-29T14:23:06.186Z"
                },
                {
                    "object_ref": "relationship--bf08412c-f1ab-4b48-956b-177ce2474a2e",
                    "object_modified": "2026-04-29T14:23:06.186Z"
                },
                {
                    "object_ref": "relationship--bf0e7347-1636-4b5e-9e2a-8b93177e5f85",
                    "object_modified": "2026-07-31T20:48:14.269Z"
                },
                {
                    "object_ref": "relationship--bf8f90a2-4d3a-436d-87d0-eff060fb2302",
                    "object_modified": "2026-04-29T14:23:06.187Z"
                },
                {
                    "object_ref": "relationship--bf9f227c-e306-4257-add1-39c7c2e42040",
                    "object_modified": "2026-04-29T14:23:06.187Z"
                },
                {
                    "object_ref": "relationship--bfe38597-c92b-4989-9687-3dd20a21f82d",
                    "object_modified": "2026-04-29T14:23:06.188Z"
                },
                {
                    "object_ref": "relationship--bff99f91-e1a9-4379-a2d9-5a99615a95d1",
                    "object_modified": "2026-07-31T20:48:46.061Z"
                },
                {
                    "object_ref": "relationship--c004d8e5-8079-4f6f-90ed-93cff4f69940",
                    "object_modified": "2026-04-29T14:23:06.188Z"
                },
                {
                    "object_ref": "relationship--c047df7c-3ed7-455f-8b13-14ced8e93fef",
                    "object_modified": "2026-04-29T14:23:06.188Z"
                },
                {
                    "object_ref": "relationship--c09375e4-1c59-48f2-9151-f42151263bce",
                    "object_modified": "2026-07-31T20:48:19.944Z"
                },
                {
                    "object_ref": "relationship--c09623fc-ee06-4d8e-828f-23d2bc895aaf",
                    "object_modified": "2026-04-29T14:23:06.189Z"
                },
                {
                    "object_ref": "relationship--c0efb24a-2329-401a-bba6-817f2867bb3f",
                    "object_modified": "2026-04-29T14:23:06.189Z"
                },
                {
                    "object_ref": "relationship--c0fb868d-9b36-492d-9577-626ecf9d50c0",
                    "object_modified": "2026-04-29T14:23:06.189Z"
                },
                {
                    "object_ref": "relationship--c107c735-71bd-427c-879f-195a323e5769",
                    "object_modified": "2026-10-07T20:30:30.035Z"
                },
                {
                    "object_ref": "relationship--c1154a56-6f5f-4760-8b34-79b0e8a79c1f",
                    "object_modified": "2026-07-31T20:48:16.241Z"
                },
                {
                    "object_ref": "relationship--c137fcd2-ce51-4e17-9c2f-f1aaf9b64ce7",
                    "object_modified": "2026-09-03T20:31:39.328Z"
                },
                {
                    "object_ref": "relationship--c1849779-3ef0-4e68-b970-a518976a7567",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c195a0e9-d46c-487f-9a96-b138e9ca05d2",
                    "object_modified": "2026-04-29T14:23:06.190Z"
                },
                {
                    "object_ref": "relationship--c19a88bb-b98c-4a2e-9b8f-9dcacd73a9c0",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c1d77f83-23ec-4128-afd1-ed8ea12281a2",
                    "object_modified": "2026-04-29T14:23:06.190Z"
                },
                {
                    "object_ref": "relationship--c1e051ab-0a11-4d29-b98f-aa442ab69553",
                    "object_modified": "2026-04-29T14:23:06.190Z"
                },
                {
                    "object_ref": "relationship--c1fc8829-4a5e-4633-8785-b5601f5067a9",
                    "object_modified": "2026-04-29T14:23:06.190Z"
                },
                {
                    "object_ref": "relationship--c233df49-e450-4151-8a0f-1765faf3d75a",
                    "object_modified": "2026-04-29T14:23:06.191Z"
                },
                {
                    "object_ref": "relationship--c247e63d-f1f8-4b69-b72f-866bfd14d4bb",
                    "object_modified": "2026-04-29T14:23:06.191Z"
                },
                {
                    "object_ref": "relationship--c27e676e-1ac0-4ec8-bf9d-f540969c6b6f",
                    "object_modified": "2026-04-29T14:23:06.191Z"
                },
                {
                    "object_ref": "relationship--c297179c-66a5-41b4-9a12-59f7480bc25e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c2a6b6b8-d9ef-45e1-9b7f-5fdc039e190f",
                    "object_modified": "2026-04-29T14:23:06.191Z"
                },
                {
                    "object_ref": "relationship--c2fe42b4-6750-4b51-86b7-6c37fbfdef2d",
                    "object_modified": "2026-04-29T14:23:06.192Z"
                },
                {
                    "object_ref": "relationship--c347b69c-e3f6-4eca-ba57-0781c7dc8eac",
                    "object_modified": "2026-04-29T14:23:06.192Z"
                },
                {
                    "object_ref": "relationship--c37f097a-9698-412f-9e96-4d350bcd2790",
                    "object_modified": "2026-04-29T14:23:06.192Z"
                },
                {
                    "object_ref": "relationship--c39be68a-e208-47ac-a7be-6eb6e84d6608",
                    "object_modified": "2026-04-29T14:23:06.193Z"
                },
                {
                    "object_ref": "relationship--c3c23e7f-f778-4cd6-b2ac-69c1a5615d66",
                    "object_modified": "2026-04-29T14:23:06.193Z"
                },
                {
                    "object_ref": "relationship--c4122b58-f1b2-4656-a715-55016700bf75",
                    "object_modified": "2026-04-29T14:23:06.193Z"
                },
                {
                    "object_ref": "relationship--c41d20c8-b99e-4de8-a0e5-3e0ef3b4275b",
                    "object_modified": "2026-04-29T14:23:06.193Z"
                },
                {
                    "object_ref": "relationship--c44ad0d0-0d7e-4a31-877b-ac69b679cf8d",
                    "object_modified": "2026-04-29T14:23:06.193Z"
                },
                {
                    "object_ref": "relationship--c4a50132-a210-4093-878d-3d6df23ed26e",
                    "object_modified": "2026-04-29T14:23:06.194Z"
                },
                {
                    "object_ref": "relationship--c4b036ee-be86-48cb-9f01-ab8f78e5bb37",
                    "object_modified": "2026-04-29T14:23:06.194Z"
                },
                {
                    "object_ref": "relationship--c4dd7251-ed87-4629-86b5-090e52a82df2",
                    "object_modified": "2026-04-29T14:23:06.194Z"
                },
                {
                    "object_ref": "relationship--c4fa7c43-1b74-4d65-ade9-72b679f4bb49",
                    "object_modified": "2026-04-29T14:23:06.194Z"
                },
                {
                    "object_ref": "relationship--c52501e6-6c33-4c10-9c20-b868f71f8035",
                    "object_modified": "2026-04-29T14:23:06.195Z"
                },
                {
                    "object_ref": "relationship--c53a4f46-f8db-4d89-b21b-9f249c8297a1",
                    "object_modified": "2026-04-29T14:23:06.195Z"
                },
                {
                    "object_ref": "relationship--c563bfb5-173f-4a96-812b-2aad8057f09f",
                    "object_modified": "2026-09-03T20:31:39.339Z"
                },
                {
                    "object_ref": "relationship--c56f7ce6-a077-41d3-94d7-440f85e61786",
                    "object_modified": "2026-04-29T14:23:06.195Z"
                },
                {
                    "object_ref": "relationship--c58563a8-d757-4476-8ae2-beb2acce38b3",
                    "object_modified": "2026-04-29T14:23:06.195Z"
                },
                {
                    "object_ref": "relationship--c596f45a-ad65-4673-b316-05378175f35e",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c59a3d89-c8fa-4c5d-813e-f4495d892d1a",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c5a69738-3e80-421d-aba2-bdab8a4029fd",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c5dd0d66-99f1-4efd-b0f9-bf9f9118ff16",
                    "object_modified": "2026-07-31T20:48:33.264Z"
                },
                {
                    "object_ref": "relationship--c5fd0969-c151-4849-94c2-83e2e208cff7",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c610871a-a31d-4597-8e44-f694dfe9c5b8",
                    "object_modified": "2026-10-07T21:15:57.384Z"
                },
                {
                    "object_ref": "relationship--c613899c-1550-4a90-8ae9-7a964147093f",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c617dafd-fb30-41e2-bf5d-1287d826dcd1",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c61fb9cc-8a3c-46e6-8ae6-856aa7f16723",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c6258ef7-95dc-43ef-b0c2-a20011a48699",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c64c1841-bd66-4651-b751-ee3d54962790",
                    "object_modified": "2026-10-07T20:20:25.480Z"
                },
                {
                    "object_ref": "relationship--c64f2ed2-f7a7-4333-b0d3-d687ffb7ad6b",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c6520346-fe47-44ce-af75-d99004ac2977",
                    "object_modified": "2026-04-29T14:23:06.196Z"
                },
                {
                    "object_ref": "relationship--c65e39eb-f6d1-4e3a-9070-b2fa7ea35b36",
                    "object_modified": "2026-04-29T14:23:06.197Z"
                },
                {
                    "object_ref": "relationship--c67e3535-69a9-4234-8170-4ad6efc632b7",
                    "object_modified": "2026-04-29T14:23:06.197Z"
                },
                {
                    "object_ref": "relationship--c69eab3c-861c-45f5-8858-a595fcc7e6f6",
                    "object_modified": "2026-09-03T20:31:39.350Z"
                },
                {
                    "object_ref": "relationship--c71fafe8-ed54-44d1-be6e-9a018eb9a90f",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c78f497f-01c3-4efb-aa74-92b700b9c02b",
                    "object_modified": "2026-04-29T14:23:06.198Z"
                },
                {
                    "object_ref": "relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562",
                    "object_modified": "2026-04-29T14:23:06.198Z"
                },
                {
                    "object_ref": "relationship--c7ab3b87-4a54-4a24-9ed0-1ed360c3e03e",
                    "object_modified": "2026-09-25T18:29:28.505Z"
                },
                {
                    "object_ref": "relationship--c7ae1f86-2029-4354-896b-baace526bf3c",
                    "object_modified": "2026-04-29T14:23:06.198Z"
                },
                {
                    "object_ref": "relationship--c7c75b98-3fb2-46fd-93de-4e59f3181dae",
                    "object_modified": "2026-04-20T20:58:49.920Z"
                },
                {
                    "object_ref": "relationship--c7fdb9b7-2155-4a8a-94f2-9a82f7c3b13f",
                    "object_modified": "2026-10-07T20:37:23.011Z"
                },
                {
                    "object_ref": "relationship--c80a479e-5e7b-449b-ace0-b5ced0d2d442",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c8222300-6c5e-42d6-ae67-3595407b89fd",
                    "object_modified": "2026-04-29T14:23:06.199Z"
                },
                {
                    "object_ref": "relationship--c8385036-b439-4360-8a56-cb595511e239",
                    "object_modified": "2026-09-25T18:33:26.971Z"
                },
                {
                    "object_ref": "relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c",
                    "object_modified": "2026-04-29T14:23:06.199Z"
                },
                {
                    "object_ref": "relationship--c892fb0a-4c9f-4332-a0d3-974a8fcab565",
                    "object_modified": "2026-04-20T20:54:22.907Z"
                },
                {
                    "object_ref": "relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6",
                    "object_modified": "2026-04-29T14:23:06.199Z"
                },
                {
                    "object_ref": "relationship--c8c5e01d-cf78-402c-9f52-6f5c306fd300",
                    "object_modified": "2026-04-29T14:23:06.200Z"
                },
                {
                    "object_ref": "relationship--c8d9d10f-bf72-4340-a613-fa08f2dde557",
                    "object_modified": "2026-09-25T16:48:19.176Z"
                },
                {
                    "object_ref": "relationship--c8dd2735-bd04-4413-847d-316b77c6de19",
                    "object_modified": "2026-09-03T20:28:49.091Z"
                },
                {
                    "object_ref": "relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a",
                    "object_modified": "2026-08-04T20:48:45.125Z"
                },
                {
                    "object_ref": "relationship--c9065f74-556d-4728-8072-f96642e70316",
                    "object_modified": "2026-04-29T14:23:06.200Z"
                },
                {
                    "object_ref": "relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d",
                    "object_modified": "2026-04-29T14:23:06.200Z"
                },
                {
                    "object_ref": "relationship--c91514db-4e02-459e-9ff4-5092fdffb049",
                    "object_modified": "2026-04-29T14:23:06.200Z"
                },
                {
                    "object_ref": "relationship--c9395e2a-afaf-427c-bcb2-ae663d72c05c",
                    "object_modified": "2026-04-29T14:23:06.200Z"
                },
                {
                    "object_ref": "relationship--c95850f4-4616-435c-b237-f1985833d40e",
                    "object_modified": "2026-04-29T14:23:06.201Z"
                },
                {
                    "object_ref": "relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c9efe378-d028-4c09-83c7-491fadc3a1f9",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--c9fb4adb-8064-426a-838d-c93674fb380b",
                    "object_modified": "2026-04-29T14:23:06.201Z"
                },
                {
                    "object_ref": "relationship--ca13a117-aae0-4802-878b-c09f4a04dd31",
                    "object_modified": "2026-04-29T14:23:06.201Z"
                },
                {
                    "object_ref": "relationship--ca225ea0-e813-4205-98db-707b474ae24f",
                    "object_modified": "2026-04-29T14:23:06.201Z"
                },
                {
                    "object_ref": "relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb",
                    "object_modified": "2026-04-29T14:23:06.202Z"
                },
                {
                    "object_ref": "relationship--ca5c7ae7-5273-4888-bc50-183d6e200972",
                    "object_modified": "2026-04-29T14:23:06.202Z"
                },
                {
                    "object_ref": "relationship--ca64a927-f050-41b3-80d3-93d22cdef26a",
                    "object_modified": "2026-09-03T20:30:36.692Z"
                },
                {
                    "object_ref": "relationship--ca768c2a-0f14-471c-90a5-bce649e88d51",
                    "object_modified": "2026-04-29T14:23:06.202Z"
                },
                {
                    "object_ref": "relationship--ca77cbbf-8938-4dd0-b454-df5703bc1718",
                    "object_modified": "2026-07-31T20:48:54.499Z"
                },
                {
                    "object_ref": "relationship--cad91f87-7cc7-4771-8c7b-1599793ed3c1",
                    "object_modified": "2026-04-29T14:23:06.202Z"
                },
                {
                    "object_ref": "relationship--cae90fbb-ba0d-4a9a-9da3-b9f32ab1cd07",
                    "object_modified": "2026-04-29T14:23:06.202Z"
                },
                {
                    "object_ref": "relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b",
                    "object_modified": "2026-07-31T20:48:23.388Z"
                },
                {
                    "object_ref": "relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb47a3bb-daec-4aa1-9a92-af2a61bb65cd",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb6d67c0-33ba-4c49-ae70-d0e4f0f68794",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb6e6679-42b7-48ce-b546-7c45cdefb4c5",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb7b5a86-1591-407d-a3cf-c7f86f60934b",
                    "object_modified": "2026-10-07T21:56:35.264Z"
                },
                {
                    "object_ref": "relationship--cb7fc6bb-f62d-4316-91d3-ecab283e2976",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb84ce4c-4fb7-4e16-b10c-c932d34f0699",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cb993689-bb59-4c96-b9fd-42cfcb92d76f",
                    "object_modified": "2026-04-29T14:23:06.203Z"
                },
                {
                    "object_ref": "relationship--cba8313b-c338-45f7-88ef-a514094882ac",
                    "object_modified": "2026-04-29T14:23:06.204Z"
                },
                {
                    "object_ref": "relationship--cbc62104-d3df-499c-9630-b510e99f3acd",
                    "object_modified": "2026-04-29T14:23:06.204Z"
                },
                {
                    "object_ref": "relationship--cbc65a60-3b40-4ecf-a10d-8ef1be72568d",
                    "object_modified": "2026-04-29T14:23:06.204Z"
                },
                {
                    "object_ref": "relationship--cbee31a0-716c-4b10-83f0-aa889bfb4749",
                    "object_modified": "2026-04-29T14:23:06.204Z"
                },
                {
                    "object_ref": "relationship--cc1f9236-42f2-463f-9894-44197fbe2867",
                    "object_modified": "2026-04-29T14:23:06.204Z"
                },
                {
                    "object_ref": "relationship--cc5c77ce-c5a3-4791-b80e-09d35282443a",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--cca191a1-3c50-4d4f-8f79-4247e58af610",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--ccae6e5d-8a9e-4bab-ae77-26a2bd722f67",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--ccbb44ad-2220-4260-99ce-9142c44fc797",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--ccc5523f-b7a7-4bd1-a9a2-eb00f44cc778",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7",
                    "object_modified": "2026-04-29T14:23:06.205Z"
                },
                {
                    "object_ref": "relationship--ccef2177-65ca-4126-bcd9-dd6ffb4c5e06",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--cd0ba68b-398b-4df1-b9bd-c1ea3ba0791f",
                    "object_modified": "2026-04-29T14:23:06.206Z"
                },
                {
                    "object_ref": "relationship--cd18f19c-71dc-4b7b-929c-647804d4c614",
                    "object_modified": "2026-04-29T14:23:06.206Z"
                },
                {
                    "object_ref": "relationship--cd1be463-233c-43c8-b03d-fa0d6bdd8427",
                    "object_modified": "2026-04-20T20:54:19.034Z"
                },
                {
                    "object_ref": "relationship--cd645dbe-000a-43f9-86e6-622bb1ab1053",
                    "object_modified": "2026-04-29T14:23:06.206Z"
                },
                {
                    "object_ref": "relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8",
                    "object_modified": "2026-07-31T20:48:14.296Z"
                },
                {
                    "object_ref": "relationship--cdc5aea4-1aac-4e6b-86cd-39617629d96b",
                    "object_modified": "2026-08-04T20:48:45.139Z"
                },
                {
                    "object_ref": "relationship--ce3aad7e-1e15-40c7-916b-e25a647e9986",
                    "object_modified": "2026-04-29T14:23:06.207Z"
                },
                {
                    "object_ref": "relationship--ce4d77f4-6b9f-435f-94ca-52bc4a90522b",
                    "object_modified": "2026-10-09T00:06:24.650Z"
                },
                {
                    "object_ref": "relationship--ce5833db-4cd2-4034-ac97-8a02b14e0095",
                    "object_modified": "2026-04-29T14:23:06.207Z"
                },
                {
                    "object_ref": "relationship--ce64ed04-f0ff-4897-b636-3177c9c5d9bb",
                    "object_modified": "2026-07-31T20:48:33.272Z"
                },
                {
                    "object_ref": "relationship--cea316fe-8a9d-4e7c-ab2e-6134585bb69f",
                    "object_modified": "2026-04-29T14:23:06.208Z"
                },
                {
                    "object_ref": "relationship--cf125e14-158c-4bd2-9d86-61f349704c99",
                    "object_modified": "2026-09-26T04:58:28.802Z"
                },
                {
                    "object_ref": "relationship--cf3d020e-5ca7-4867-a502-654e445cc45c",
                    "object_modified": "2026-07-31T21:11:05.595Z"
                },
                {
                    "object_ref": "relationship--cf528b10-a4e6-49ed-8bc8-4629115d7752",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cf53ff89-3c31-4f8d-83a1-b74dce4c558d",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cf568097-5db4-4518-a786-87870dec04e0",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cf8a816c-30ee-4147-a48f-d797fb145a04",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cf8acb4a-4918-4155-99a7-ee938278bbca",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--cfaead3c-3db5-400f-bd15-dfbc57cf0185",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cfb7dbe9-53ac-4b51-b031-3ae26ad1e1a5",
                    "object_modified": "2026-04-29T14:23:06.209Z"
                },
                {
                    "object_ref": "relationship--cfc97955-3fda-4152-94c6-106f58a5579b",
                    "object_modified": "2026-04-20T20:54:16.106Z"
                },
                {
                    "object_ref": "relationship--cfea8d23-2078-4741-bc12-7afa7a2dffa0",
                    "object_modified": "2026-04-29T14:23:06.210Z"
                },
                {
                    "object_ref": "relationship--d015831c-a253-491d-9106-4ad0ccb43c3b",
                    "object_modified": "2026-04-29T14:23:06.210Z"
                },
                {
                    "object_ref": "relationship--d02812b2-23c3-4dce-bf94-c6e464e86fab",
                    "object_modified": "2026-04-29T14:23:06.210Z"
                },
                {
                    "object_ref": "relationship--d035ee22-59f0-4d4e-9420-d26f43533b06",
                    "object_modified": "2026-07-31T20:48:56.751Z"
                },
                {
                    "object_ref": "relationship--d03785b3-9b51-45f2-aff5-029555c53826",
                    "object_modified": "2026-04-29T14:23:06.210Z"
                },
                {
                    "object_ref": "relationship--d03de729-9235-4ceb-a1c0-935e2088020b",
                    "object_modified": "2026-04-29T14:23:06.210Z"
                },
                {
                    "object_ref": "relationship--d0fb800d-f962-4e4f-a308-5e99374203c1",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--d11ef23b-689d-4841-a225-bdaa202465c9",
                    "object_modified": "2026-10-07T20:29:05.934Z"
                },
                {
                    "object_ref": "relationship--d1388bba-9869-4e3e-a6c9-430784ad924d",
                    "object_modified": "2026-08-04T20:48:45.153Z"
                },
                {
                    "object_ref": "relationship--d1445579-245b-4698-a7df-365379e0d36d",
                    "object_modified": "2026-04-29T14:23:06.212Z"
                },
                {
                    "object_ref": "relationship--d16098fd-9b2d-479c-a25a-f970bce86f94",
                    "object_modified": "2026-10-08T22:17:42.611Z"
                },
                {
                    "object_ref": "relationship--d16e8909-d055-4174-aeb1-22c0613b2f73",
                    "object_modified": "2026-04-29T14:23:06.212Z"
                },
                {
                    "object_ref": "relationship--d1bd77d4-9f1a-41ee-bf64-0aa7438e6896",
                    "object_modified": "2026-04-29T14:23:06.212Z"
                },
                {
                    "object_ref": "relationship--d1d98f8c-aea2-4f06-9b0d-c543ed42c6a4",
                    "object_modified": "2026-04-29T14:23:06.212Z"
                },
                {
                    "object_ref": "relationship--d23fd724-563d-4f49-8bcd-09c653728cd3",
                    "object_modified": "2026-04-29T14:23:06.213Z"
                },
                {
                    "object_ref": "relationship--d2985b8a-7a29-4b57-b2f1-cddd79fe4242",
                    "object_modified": "2026-04-29T14:23:06.213Z"
                },
                {
                    "object_ref": "relationship--d2a434c7-4428-435e-ae6b-e54012f29606",
                    "object_modified": "2026-04-29T14:23:06.213Z"
                },
                {
                    "object_ref": "relationship--d2dc57eb-5be2-4f9c-a4f7-18d2085ff412",
                    "object_modified": "2026-07-31T20:48:35.867Z"
                },
                {
                    "object_ref": "relationship--d304ae90-33b1-4cfe-b60e-6c93780f4bf9",
                    "object_modified": "2026-09-26T03:55:17.193Z"
                },
                {
                    "object_ref": "relationship--d3266f04-3453-492d-b9ea-6fb9d0ce3999",
                    "object_modified": "2026-09-03T20:31:39.364Z"
                },
                {
                    "object_ref": "relationship--d3564f1f-8637-4878-a66a-3e8ea46f7a72",
                    "object_modified": "2026-09-03T20:30:36.704Z"
                },
                {
                    "object_ref": "relationship--d3717846-eaab-4fde-99f6-a972dec9323b",
                    "object_modified": "2026-07-31T21:11:05.637Z"
                },
                {
                    "object_ref": "relationship--d3a24d5e-ae6e-4427-a1db-ae87b7a2b6e4",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d3c94120-e6b5-4bd2-88f0-9c73f76b0104",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d3d4f469-9847-41ef-a478-5eaf6003d483",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d3ec223b-9dca-4e5e-8d09-b69a04110eec",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d40fab57-a843-45b9-a70d-6c795e1cc476",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d45464ea-98b2-4f57-8f42-1cccc49e075f",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d455330d-f190-4854-8087-4c2c37003b45",
                    "object_modified": "2026-04-29T14:23:06.215Z"
                },
                {
                    "object_ref": "relationship--d462143c-69d1-44c9-b657-b64deb12eab8",
                    "object_modified": "2026-04-29T14:23:06.216Z"
                },
                {
                    "object_ref": "relationship--d48894cb-457e-4a81-82b4-2d735aea5128",
                    "object_modified": "2026-09-03T20:28:49.103Z"
                },
                {
                    "object_ref": "relationship--d4968f45-d06b-4843-8f72-6e08beb94cab",
                    "object_modified": "2026-07-31T20:48:28.701Z"
                },
                {
                    "object_ref": "relationship--d4a6d928-ac0c-4b27-a3bc-e42703b5859c",
                    "object_modified": "2026-04-29T14:23:06.216Z"
                },
                {
                    "object_ref": "relationship--d4da5e90-7986-4c8a-bfb6-df4c0586ce87",
                    "object_modified": "2026-07-31T21:11:05.650Z"
                },
                {
                    "object_ref": "relationship--d4f64f95-42cd-46e6-8fcf-25ef0d868f5b",
                    "object_modified": "2026-04-29T14:23:06.216Z"
                },
                {
                    "object_ref": "relationship--d50a3d89-c8fa-4c5d-813e-f4495d892d1a",
                    "object_modified": "2026-09-03T20:31:39.376Z"
                },
                {
                    "object_ref": "relationship--d5238e56-6e41-44ed-a6f5-ebe49f5443d7",
                    "object_modified": "2026-10-07T21:14:38.956Z"
                },
                {
                    "object_ref": "relationship--d5289c2e-e5c4-443d-94ec-ce9a44992065",
                    "object_modified": "2026-04-29T14:23:06.217Z"
                },
                {
                    "object_ref": "relationship--d55057c5-988d-4f66-bfba-650c49259d01",
                    "object_modified": "2026-04-29T14:23:06.217Z"
                },
                {
                    "object_ref": "relationship--d58d8b19-90bc-4a7f-840d-076be296ff20",
                    "object_modified": "2026-04-29T14:23:06.217Z"
                },
                {
                    "object_ref": "relationship--d5b532fe-3df9-4f92-a0f0-9c92823cdb6a",
                    "object_modified": "2026-04-29T14:23:06.217Z"
                },
                {
                    "object_ref": "relationship--d5e20226-108d-473c-b396-0fc10f11e129",
                    "object_modified": "2026-10-07T21:41:50.604Z"
                },
                {
                    "object_ref": "relationship--d5e908f9-eea1-4e55-a406-f24c5dc74b2d",
                    "object_modified": "2026-09-03T20:30:36.716Z"
                },
                {
                    "object_ref": "relationship--d611b750-95e5-4f73-8f16-38db0a34a2e0",
                    "object_modified": "2026-04-29T14:23:06.218Z"
                },
                {
                    "object_ref": "relationship--d65646f0-f90c-4415-bbde-cce61f13898f",
                    "object_modified": "2026-04-29T14:23:06.218Z"
                },
                {
                    "object_ref": "relationship--d67ae959-9014-4501-b963-42bee03a5e3b",
                    "object_modified": "2026-07-31T20:48:17.871Z"
                },
                {
                    "object_ref": "relationship--d67feaac-73ac-47b1-91ec-f537105afc58",
                    "object_modified": "2026-04-29T14:23:06.218Z"
                },
                {
                    "object_ref": "relationship--d6a2a1a8-8f5b-4e94-8fce-8edd8a17627a",
                    "object_modified": "2026-04-29T14:23:06.219Z"
                },
                {
                    "object_ref": "relationship--d72458b4-b72b-4f0b-96da-eb3d9c6ef9a2",
                    "object_modified": "2026-04-29T14:23:06.219Z"
                },
                {
                    "object_ref": "relationship--d72e7d01-56be-4fbd-8957-3384533ba83b",
                    "object_modified": "2026-04-29T14:23:06.219Z"
                },
                {
                    "object_ref": "relationship--d775a6ed-4a60-41f4-ac06-da86c27cd1de",
                    "object_modified": "2026-04-29T14:23:06.219Z"
                },
                {
                    "object_ref": "relationship--d7ab9f93-163e-4000-9573-674a7e4de44c",
                    "object_modified": "2026-04-29T14:23:06.220Z"
                },
                {
                    "object_ref": "relationship--d7b07d40-fbdb-41e9-b610-57de10fa41e5",
                    "object_modified": "2026-04-29T14:23:06.220Z"
                },
                {
                    "object_ref": "relationship--d7ea83fa-87c7-4d36-96d5-aee554504040",
                    "object_modified": "2026-04-29T14:23:06.220Z"
                },
                {
                    "object_ref": "relationship--d80c615e-addc-49c8-a2b9-991e24678d86",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--d80f9deb-ba2a-4a07-aa23-81c423cf4a18",
                    "object_modified": "2026-04-29T14:23:06.220Z"
                },
                {
                    "object_ref": "relationship--d8354850-bd4c-4bd9-a585-b107f5f1398f",
                    "object_modified": "2026-04-29T14:23:06.220Z"
                },
                {
                    "object_ref": "relationship--d854cc38-adf7-485d-96b5-70606f6cb87e",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d8911566-f622-4a01-b765-514dbbfd8201",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d89d9778-4695-4c97-bf6d-1d0fbabb41fa",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d8f45959-e0fc-4b4f-a074-a3acea926300",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d8f95008-33c9-4572-9916-023d8de449b1",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d90aeeb6-3686-483a-8403-6514ecfe1a50",
                    "object_modified": "2026-04-29T14:23:06.221Z"
                },
                {
                    "object_ref": "relationship--d9165ecb-bc10-4189-a7e4-057bdf05bf3f",
                    "object_modified": "2026-04-29T14:23:06.222Z"
                },
                {
                    "object_ref": "relationship--d96788b4-55dd-48df-bb9b-83b33ca24813",
                    "object_modified": "2026-04-29T14:23:06.222Z"
                },
                {
                    "object_ref": "relationship--d99a28f4-6536-4d73-9241-497cda9a8878",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--d99e23f0-16ae-4391-a3e4-a38181114a22",
                    "object_modified": "2026-09-26T01:59:07.450Z"
                },
                {
                    "object_ref": "relationship--d99fecbc-a7ea-4430-b933-afd239c4555b",
                    "object_modified": "2026-04-29T14:23:06.222Z"
                },
                {
                    "object_ref": "relationship--d9a351b5-1d77-4f16-a191-1a8992c5bb5b",
                    "object_modified": "2026-04-29T14:23:06.222Z"
                },
                {
                    "object_ref": "relationship--d9d6acfe-c905-41fd-9e29-8c3b047e4916",
                    "object_modified": "2026-10-09T16:40:38.025Z"
                },
                {
                    "object_ref": "relationship--d9de58a6-58fd-499c-ba7d-588239297179",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--d9fa7d68-a07c-4cf0-bb01-14e2c70c21d5",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--da144dd2-c949-4a7f-8c8d-0cb27c52196a",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--da246386-12c6-4d7e-adc2-f3148686d6c1",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--da38a045-d29a-4c08-9951-c8e520229584",
                    "object_modified": "2026-08-04T20:48:45.181Z"
                },
                {
                    "object_ref": "relationship--da6aa4ab-039e-40fc-8188-8006ccd2ea8c",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--da771d72-c778-4c9a-acb4-01b5fc3d36c0",
                    "object_modified": "2026-04-29T14:23:06.223Z"
                },
                {
                    "object_ref": "relationship--da7ee266-be41-4b80-a71b-7e067e6bdb5a",
                    "object_modified": "2026-09-26T01:52:11.789Z"
                },
                {
                    "object_ref": "relationship--da987131-bf37-4730-9914-323879d2b5c3",
                    "object_modified": "2026-04-29T14:23:06.224Z"
                },
                {
                    "object_ref": "relationship--dac96d76-b9b8-4278-9f5b-62f4992e2ac8",
                    "object_modified": "2026-04-29T14:23:06.224Z"
                },
                {
                    "object_ref": "relationship--dae4ef38-bd41-45e0-b780-ea9d411386d3",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--db221f13-ffd3-49bb-bbe2-8f8a0023a5a0",
                    "object_modified": "2026-10-07T21:21:20.378Z"
                },
                {
                    "object_ref": "relationship--db5e5a2a-dc41-4f04-910e-ab4dfccd1e0d",
                    "object_modified": "2026-04-29T14:23:06.225Z"
                },
                {
                    "object_ref": "relationship--db6c3e5b-f1f5-4a3a-b391-5a973e58084b",
                    "object_modified": "2026-10-07T21:23:27.994Z"
                },
                {
                    "object_ref": "relationship--dbcc492c-782e-4418-8373-dbc7a76498b0",
                    "object_modified": "2026-04-29T14:23:06.225Z"
                },
                {
                    "object_ref": "relationship--dbdd9a97-81df-40b8-b72d-ac67d121b8b3",
                    "object_modified": "2026-04-29T14:23:06.225Z"
                },
                {
                    "object_ref": "relationship--dc35c44a-a90c-48a1-8811-af2618216e42",
                    "object_modified": "2026-04-29T14:23:06.226Z"
                },
                {
                    "object_ref": "relationship--dc4ea40d-059d-4952-a525-5f915c7f23ba",
                    "object_modified": "2026-09-25T18:34:17.564Z"
                },
                {
                    "object_ref": "relationship--dc5736b5-b906-41e9-b772-53d92b1aa48c",
                    "object_modified": "2026-04-29T14:23:06.226Z"
                },
                {
                    "object_ref": "relationship--dd164aa3-1bec-4d3b-afb4-25f0e3a29f9f",
                    "object_modified": "2026-04-20T20:58:41.108Z"
                },
                {
                    "object_ref": "relationship--dd350208-e49c-412f-b249-f09d8203f1eb",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--dda89758-9d0b-446d-b594-85acc7f9cb90",
                    "object_modified": "2026-04-29T14:23:06.228Z"
                },
                {
                    "object_ref": "relationship--dded2d68-35c7-42c4-af10-efe7731673e3",
                    "object_modified": "2026-04-29T14:23:06.228Z"
                },
                {
                    "object_ref": "relationship--de370506-01db-412f-a6fb-57c4014de788",
                    "object_modified": "2026-04-29T14:23:06.228Z"
                },
                {
                    "object_ref": "relationship--de520a68-3ad7-4bd2-a4a6-2380e328e929",
                    "object_modified": "2026-10-07T17:52:49.636Z"
                },
                {
                    "object_ref": "relationship--de6a1c7c-8d90-4f5c-8618-7c7ea9a2da89",
                    "object_modified": "2026-04-29T14:23:06.228Z"
                },
                {
                    "object_ref": "relationship--de973619-e66f-4cb8-92fc-0d5fe85214fa",
                    "object_modified": "2026-07-31T20:48:20.031Z"
                },
                {
                    "object_ref": "relationship--dead5325-7efe-4dcc-bf78-42b9190f74da",
                    "object_modified": "2026-04-29T14:23:06.229Z"
                },
                {
                    "object_ref": "relationship--deb83319-bc5a-4b9b-a44a-bd369b899601",
                    "object_modified": "2026-04-29T14:23:06.229Z"
                },
                {
                    "object_ref": "relationship--def57041-6bb4-453a-bf04-188b9e97a35d",
                    "object_modified": "2026-04-29T14:23:06.229Z"
                },
                {
                    "object_ref": "relationship--df321d74-25d6-42da-80e8-3c9a291cb471",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--df67d728-289e-4d04-9635-d018c0764ce9",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--df6da4ec-cbe8-4f93-a41f-3726a9491938",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--df7b521e-4496-432f-a61d-3094d0c7bc23",
                    "object_modified": "2026-09-03T20:30:36.729Z"
                },
                {
                    "object_ref": "relationship--df80e2b6-5672-4f26-a19c-a394f3731f24",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--df9f5a5b-0662-4904-8e57-bc25c244a6da",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--dfb20521-91c2-4f55-b92a-dab959759b78",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--dfc355bd-ee2e-4c80-a61c-0ca700dbc006",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--dfc6fb8e-87f4-4a50-a21e-1df2ad35d3c6",
                    "object_modified": "2026-09-03T20:30:36.740Z"
                },
                {
                    "object_ref": "relationship--dfcfa2cf-6873-46a7-a924-68783378c15d",
                    "object_modified": "2026-04-29T14:23:06.230Z"
                },
                {
                    "object_ref": "relationship--dfd0dc6c-33ad-44a4-9def-1d8e23e278fb",
                    "object_modified": "2026-07-31T20:48:28.730Z"
                },
                {
                    "object_ref": "relationship--e00efbb9-4663-4a0a-8fbe-d7dcc4395fc9",
                    "object_modified": "2026-04-29T14:23:06.231Z"
                },
                {
                    "object_ref": "relationship--e0152ca1-4ad2-4dce-9231-cad70c802d62",
                    "object_modified": "2026-10-09T00:09:49.940Z"
                },
                {
                    "object_ref": "relationship--e04e99cd-cf77-45fa-b4e9-dda96488aacf",
                    "object_modified": "2026-10-07T20:11:40.440Z"
                },
                {
                    "object_ref": "relationship--e060820a-5a37-4abe-b27e-e157f2d6fa27",
                    "object_modified": "2026-10-09T00:14:59.339Z"
                },
                {
                    "object_ref": "relationship--e0613dac-bb51-482a-b005-f58cf7a69e7b",
                    "object_modified": "2026-04-29T14:23:06.231Z"
                },
                {
                    "object_ref": "relationship--e08d8829-1861-45db-a724-00e8b15b6e3d",
                    "object_modified": "2026-10-07T21:46:28.706Z"
                },
                {
                    "object_ref": "relationship--e09e253c-fd28-49ae-988e-1f80d769e8b8",
                    "object_modified": "2026-04-29T14:23:06.231Z"
                },
                {
                    "object_ref": "relationship--e0aee02c-b424-4781-be10-793d71594c31",
                    "object_modified": "2026-04-29T14:23:06.231Z"
                },
                {
                    "object_ref": "relationship--e0bdfd25-c995-416e-9140-3520390da809",
                    "object_modified": "2026-09-26T01:59:42.666Z"
                },
                {
                    "object_ref": "relationship--e0d101cc-1284-4e88-82d6-227fe5d19d8a",
                    "object_modified": "2026-04-29T14:23:06.232Z"
                },
                {
                    "object_ref": "relationship--e0da1f92-82b1-4096-86c4-1aef58ca89fb",
                    "object_modified": "2026-07-31T20:48:16.248Z"
                },
                {
                    "object_ref": "relationship--e0e525c1-2c94-45b9-999f-741d0b1a5c66",
                    "object_modified": "2026-10-07T21:23:59.116Z"
                },
                {
                    "object_ref": "relationship--e100841e-fe9f-452f-8396-9aa635255efb",
                    "object_modified": "2026-04-29T14:23:06.232Z"
                },
                {
                    "object_ref": "relationship--e1269074-37f4-460b-8a2a-cd26892d4f8e",
                    "object_modified": "2026-04-29T14:23:06.232Z"
                },
                {
                    "object_ref": "relationship--e156609f-c30b-4bf5-8a1b-9689ba778a14",
                    "object_modified": "2026-07-31T21:05:26.415Z"
                },
                {
                    "object_ref": "relationship--e1653814-74cd-4885-906f-b3af88452917",
                    "object_modified": "2026-04-29T14:23:06.232Z"
                },
                {
                    "object_ref": "relationship--e17c3b74-69d8-47b2-88d4-adcaf418ab74",
                    "object_modified": "2026-04-29T14:23:06.232Z"
                },
                {
                    "object_ref": "relationship--e1f28ed0-ec35-4792-ae02-a2d003bd3df4",
                    "object_modified": "2026-04-29T14:23:06.233Z"
                },
                {
                    "object_ref": "relationship--e257913e-40ba-4a05-ba97-0c3175c966b5",
                    "object_modified": "2026-04-29T14:23:06.233Z"
                },
                {
                    "object_ref": "relationship--e323dee4-a896-4a82-85f5-d51d311b0437",
                    "object_modified": "2026-04-29T14:23:06.234Z"
                },
                {
                    "object_ref": "relationship--e347c1e5-0c5b-42bb-b8d4-fafba4bcd319",
                    "object_modified": "2026-04-29T14:23:06.235Z"
                },
                {
                    "object_ref": "relationship--e359049e-0a1f-4877-8114-ac40b8c8d4fd",
                    "object_modified": "2026-09-26T03:36:32.286Z"
                },
                {
                    "object_ref": "relationship--e36e7e4d-fb9f-4396-bbc2-260dfc53cf8b",
                    "object_modified": "2026-04-20T20:54:18.551Z"
                },
                {
                    "object_ref": "relationship--e3923fcf-5580-4c1e-bc55-33f67792cc00",
                    "object_modified": "2026-04-29T14:23:06.235Z"
                },
                {
                    "object_ref": "relationship--e3b04152-0c90-41ff-a333-c5163fa9714f",
                    "object_modified": "2026-04-29T14:23:06.235Z"
                },
                {
                    "object_ref": "relationship--e3f683d8-b15e-4134-948f-8f4bc535e86e",
                    "object_modified": "2026-10-07T21:44:41.012Z"
                },
                {
                    "object_ref": "relationship--e41a04fe-a142-4294-a9f2-576214e1f985",
                    "object_modified": "2026-04-29T14:23:06.236Z"
                },
                {
                    "object_ref": "relationship--e434db5d-f201-4411-825f-4a50e1e78c75",
                    "object_modified": "2026-04-29T14:23:06.236Z"
                },
                {
                    "object_ref": "relationship--e4850ba4-7933-4518-a9af-667cb99ff7f6",
                    "object_modified": "2026-07-31T20:48:20.054Z"
                },
                {
                    "object_ref": "relationship--e4897cee-6e09-440d-89fe-a299c696bb92",
                    "object_modified": "2026-04-29T14:23:06.236Z"
                },
                {
                    "object_ref": "relationship--e48987f0-bbe0-4b73-ba70-d5e660ef9ac8",
                    "object_modified": "2026-09-25T20:25:54.934Z"
                },
                {
                    "object_ref": "relationship--e49e0138-4247-4f3e-a42c-f0dab2f6ffbc",
                    "object_modified": "2026-04-29T14:23:06.236Z"
                },
                {
                    "object_ref": "relationship--e49fb083-b1aa-4ac9-a99e-7e9ea1542e32",
                    "object_modified": "2026-07-31T20:48:20.061Z"
                },
                {
                    "object_ref": "relationship--e4bc29f2-87c8-491d-b51b-d6cede7c1972",
                    "object_modified": "2026-04-29T14:23:06.237Z"
                },
                {
                    "object_ref": "relationship--e4c62e59-d14e-4cbc-a4a9-4f64bd523d5a",
                    "object_modified": "2026-04-29T14:23:06.237Z"
                },
                {
                    "object_ref": "relationship--e4c87389-950e-45ab-b53a-3cafb21c08a3",
                    "object_modified": "2026-04-29T14:23:06.237Z"
                },
                {
                    "object_ref": "relationship--e4e37e2e-c6fc-4a67-a1c5-b349b1cd5a79",
                    "object_modified": "2026-04-29T14:23:06.237Z"
                },
                {
                    "object_ref": "relationship--e5124e09-c11a-4af0-b19d-8e67e88de924",
                    "object_modified": "2026-10-07T20:38:12.775Z"
                },
                {
                    "object_ref": "relationship--e5590e10-2ba5-456e-a93c-8132239819a2",
                    "object_modified": "2026-10-07T21:47:06.870Z"
                },
                {
                    "object_ref": "relationship--e56064d9-388d-45b3-99a9-4eeec2e681da",
                    "object_modified": "2026-07-31T20:48:58.207Z"
                },
                {
                    "object_ref": "relationship--e5afc447-a241-4773-9a8a-3d6fd205d926",
                    "object_modified": "2026-04-29T14:23:06.238Z"
                },
                {
                    "object_ref": "relationship--e5c66301-43ae-4587-ba10-cde207b66616",
                    "object_modified": "2026-10-07T20:11:06.518Z"
                },
                {
                    "object_ref": "relationship--e5c9aacb-51e3-41d3-995d-9e6ed04a2454",
                    "object_modified": "2026-04-29T14:23:06.238Z"
                },
                {
                    "object_ref": "relationship--e607bb66-e53f-4684-b3f1-36a997e27d01",
                    "object_modified": "2026-04-29T14:23:06.238Z"
                },
                {
                    "object_ref": "relationship--e62235fe-0546-4755-ad01-fedce306ef89",
                    "object_modified": "2026-04-29T14:23:06.238Z"
                },
                {
                    "object_ref": "relationship--e627461f-f2cc-427b-8896-72db160bca24",
                    "object_modified": "2026-04-29T14:23:06.238Z"
                },
                {
                    "object_ref": "relationship--e6be2fb4-3815-4e52-8dec-2aed1dc3b7cf",
                    "object_modified": "2026-04-29T14:23:06.239Z"
                },
                {
                    "object_ref": "relationship--e6c2b27e-a549-4acc-946a-c60401a2a771",
                    "object_modified": "2026-10-07T20:07:18.139Z"
                },
                {
                    "object_ref": "relationship--e6e0ef82-2cb6-43fe-8f4a-b9e4d5a57b13",
                    "object_modified": "2026-04-29T14:23:06.239Z"
                },
                {
                    "object_ref": "relationship--e701bb90-1a4a-418c-a48b-183246f52dea",
                    "object_modified": "2026-10-07T21:54:17.166Z"
                },
                {
                    "object_ref": "relationship--e70972b7-6bd0-48f9-83ee-b7a472a3e43e",
                    "object_modified": "2026-10-07T21:23:11.786Z"
                },
                {
                    "object_ref": "relationship--e70d04d1-51e3-4d43-b3dd-111daeea14f9",
                    "object_modified": "2026-04-29T14:23:06.239Z"
                },
                {
                    "object_ref": "relationship--e7564f70-9f10-4135-9803-842cd3d2a02f",
                    "object_modified": "2026-04-29T14:23:06.240Z"
                },
                {
                    "object_ref": "relationship--e75f88e6-1ffb-467b-b488-46e91cb3e1e9",
                    "object_modified": "2026-04-29T14:23:06.240Z"
                },
                {
                    "object_ref": "relationship--e767c178-e4b2-490a-b544-bb1b2d6c7de4",
                    "object_modified": "2026-04-29T14:23:06.240Z"
                },
                {
                    "object_ref": "relationship--e79825fb-3bd0-41e7-9bdd-257cd3ab44a2",
                    "object_modified": "2026-04-29T14:23:06.240Z"
                },
                {
                    "object_ref": "relationship--e7b44697-7269-427c-a825-3c41ec6dc385",
                    "object_modified": "2026-04-20T20:58:43.015Z"
                },
                {
                    "object_ref": "relationship--e7c3b02a-a932-4561-b812-5cfadd7f9b2f",
                    "object_modified": "2026-07-31T20:48:13.568Z"
                },
                {
                    "object_ref": "relationship--e7eca1f8-1c88-4d99-996c-b93e0c66f063",
                    "object_modified": "2026-04-29T14:23:06.241Z"
                },
                {
                    "object_ref": "relationship--e8076aaa-25e1-48cf-afcd-2365a67a8029",
                    "object_modified": "2026-04-29T14:23:06.241Z"
                },
                {
                    "object_ref": "relationship--e83a79df-2555-4b2f-9ade-b9ed2689ae42",
                    "object_modified": "2026-04-29T14:23:06.241Z"
                },
                {
                    "object_ref": "relationship--e852e64c-b5e0-4e7f-a189-bbc7aa7932c7",
                    "object_modified": "2026-04-29T14:23:06.241Z"
                },
                {
                    "object_ref": "relationship--e8a72417-2ff1-4bb7-93c2-17fa0c274d3d",
                    "object_modified": "2026-07-31T20:48:20.096Z"
                },
                {
                    "object_ref": "relationship--e8af0b34-4a67-4966-a34a-c4d1b346ea15",
                    "object_modified": "2026-04-29T14:23:06.242Z"
                },
                {
                    "object_ref": "relationship--e8eaac2d-a4bf-408f-b24f-14471db7059b",
                    "object_modified": "2026-04-29T14:23:06.242Z"
                },
                {
                    "object_ref": "relationship--e8ef9bb9-1335-4418-b788-f8220dbbe4c8",
                    "object_modified": "2026-04-29T14:23:06.242Z"
                },
                {
                    "object_ref": "relationship--e904e3ea-3488-4cb8-b21a-fdc370436b53",
                    "object_modified": "2026-10-07T20:08:52.480Z"
                },
                {
                    "object_ref": "relationship--e915e12c-3d0c-4f60-b119-9414940abb0b",
                    "object_modified": "2026-04-29T14:23:06.242Z"
                },
                {
                    "object_ref": "relationship--e95fe824-4df1-49a2-abf7-5d76fb47ef42",
                    "object_modified": "2026-04-29T14:23:06.243Z"
                },
                {
                    "object_ref": "relationship--e98892d6-e036-4140-adbb-2932dba51a19",
                    "object_modified": "2026-04-29T14:23:06.243Z"
                },
                {
                    "object_ref": "relationship--e9f5096e-b9fc-459a-a303-88763b1269cc",
                    "object_modified": "2026-07-31T20:48:31.107Z"
                },
                {
                    "object_ref": "relationship--ea1ba63b-d0e1-4d1b-a098-72ce2c44a44a",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--ea211d90-b379-446f-bc5e-ae7befe5a6ff",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--ea38b054-5552-4287-b3da-c4ad7ff61e55",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--ea50253a-3220-458b-b810-ad032f2b182f",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--ea817c7a-9424-4204-90a5-6f8fb86037be",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--eaa0b30e-1dea-4dad-9a1e-33da933a8158",
                    "object_modified": "2026-04-29T14:23:06.244Z"
                },
                {
                    "object_ref": "relationship--eac550b4-3bd2-4309-8b37-b797dd0bd8a7",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eadb4ca5-ee99-4169-a926-95b1ff82e960",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eae674f9-10a2-41e6-9cd3-205af8e69d53",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eaeb3c8d-9d91-4eb0-8049-5cb99e141026",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eb171086-88e1-4f24-bd7e-c3f8b3c3283b",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eb1e05ef-58df-4c6d-acd7-5cc63ff7f44f",
                    "object_modified": "2026-09-03T20:28:49.114Z"
                },
                {
                    "object_ref": "relationship--eb5310c6-7500-4b16-8ca7-6678c6232001",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eb54882a-57a0-477f-8a2c-4a18c8d463c7",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eb65b30e-53b1-4c27-8841-ee7daec9c33b",
                    "object_modified": "2026-04-29T14:23:06.245Z"
                },
                {
                    "object_ref": "relationship--eb7f4859-4173-42e5-811c-b3df217b7d72",
                    "object_modified": "2026-09-26T03:51:49.057Z"
                },
                {
                    "object_ref": "relationship--eba478bb-7b76-4889-b82c-eda10826ffcb",
                    "object_modified": "2026-04-29T14:23:06.246Z"
                },
                {
                    "object_ref": "relationship--ebc34374-2dee-4dc1-b0b7-f31ae94dab11",
                    "object_modified": "2026-04-29T14:23:06.246Z"
                },
                {
                    "object_ref": "relationship--ebc9f35c-6f95-4bc0-b8b3-f9b515690fa0",
                    "object_modified": "2026-04-29T14:23:06.246Z"
                },
                {
                    "object_ref": "relationship--ec105f62-2552-41fa-8b07-619dc1bf9b19",
                    "object_modified": "2026-04-29T14:23:06.246Z"
                },
                {
                    "object_ref": "relationship--ec16db2c-3265-4e0a-88d3-947e198c0a64",
                    "object_modified": "2026-04-29T14:23:06.246Z"
                },
                {
                    "object_ref": "relationship--ec468947-8385-443e-8a1e-fbdebc46df8d",
                    "object_modified": "2026-04-29T14:23:06.247Z"
                },
                {
                    "object_ref": "relationship--ecaf20c0-d881-45b4-98f2-a456e07d3643",
                    "object_modified": "2026-04-29T14:23:06.247Z"
                },
                {
                    "object_ref": "relationship--eccbcd3d-ea6e-4e9d-aa15-7b6e0909b6e0",
                    "object_modified": "2026-04-29T14:23:06.247Z"
                },
                {
                    "object_ref": "relationship--ecf39e19-439f-4e9a-97c2-673ce4eb0a1a",
                    "object_modified": "2026-04-29T14:23:06.247Z"
                },
                {
                    "object_ref": "relationship--ed095993-bc85-431e-9621-437143f16d44",
                    "object_modified": "2026-04-29T14:23:06.247Z"
                },
                {
                    "object_ref": "relationship--ed3ce006-cf41-46f6-bd86-054314c130dc",
                    "object_modified": "2026-04-29T14:23:06.248Z"
                },
                {
                    "object_ref": "relationship--ed3ef546-566a-46c7-918e-7bfa10d05991",
                    "object_modified": "2026-04-29T14:23:06.248Z"
                },
                {
                    "object_ref": "relationship--ed66e087-8877-4146-a16a-44cfd144a3d8",
                    "object_modified": "2026-04-29T14:23:06.248Z"
                },
                {
                    "object_ref": "relationship--edaa6f5c-1b59-4ecb-a20f-716a61cdaccb",
                    "object_modified": "2026-04-29T14:23:06.248Z"
                },
                {
                    "object_ref": "relationship--edb0495d-5faf-40be-92e2-fcf0c0b25157",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--edccbe1f-a07a-405e-9b9a-b247ce3dcc9b",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--ede2b798-2f39-419e-a7d3-8f0c733af4c1",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--ede5f716-52cd-4833-b092-5938262cd20b",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--edf73653-b2d7-422f-b433-b6a428ff12d4",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--ee09658b-e384-4693-9318-b1e5d4a2e78a",
                    "object_modified": "2026-07-31T20:48:20.112Z"
                },
                {
                    "object_ref": "relationship--ee2fdebd-1587-4e53-a7d7-c15fcc88879d",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--ee538956-6abf-4884-bbfa-16839f6c7d63",
                    "object_modified": "2026-04-29T14:23:06.249Z"
                },
                {
                    "object_ref": "relationship--ee72cc27-2e78-47c4-8786-1351f9bcee97",
                    "object_modified": "2026-09-03T20:30:36.754Z"
                },
                {
                    "object_ref": "relationship--ee89466e-0655-4217-844d-fb8ea4f76247",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eeb2a16d-5a4c-4d58-b4ed-c21320b5c569",
                    "object_modified": "2026-10-07T17:39:31.478Z"
                },
                {
                    "object_ref": "relationship--eebae2f3-aaa1-4410-8b75-db5bdac1d4d6",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eecca3e7-4db5-40d4-b04c-13f84701acb3",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eed98f8e-3eb9-4238-9acf-c2a0be136e87",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eeeaa0d4-0ca0-468e-ae13-43ab7aba61b4",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eeeb83cb-0a8a-412b-aae2-aede7c43d8e8",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--eeeff03f-7436-4f76-8591-42075e6647d4",
                    "object_modified": "2026-04-29T14:23:06.250Z"
                },
                {
                    "object_ref": "relationship--ef60735b-c64b-465c-9e5f-46a4d3a49fb3",
                    "object_modified": "2026-04-29T14:23:06.251Z"
                },
                {
                    "object_ref": "relationship--ef615d62-fe85-4740-9c5d-5dddff9b5693",
                    "object_modified": "2026-07-31T20:48:28.768Z"
                },
                {
                    "object_ref": "relationship--ef91b940-b3ea-4403-ba03-c71b8dcc8763",
                    "object_modified": "2026-10-09T00:18:32.638Z"
                },
                {
                    "object_ref": "relationship--efb80069-e4be-4055-bd34-06d1376b4601",
                    "object_modified": "2026-04-29T14:23:06.251Z"
                },
                {
                    "object_ref": "relationship--efc4eb1c-f254-41a5-976c-31a39f3b35f6",
                    "object_modified": "2026-04-29T14:23:06.251Z"
                },
                {
                    "object_ref": "relationship--efe09c77-8ba8-4735-b1c9-5c9c01a67320",
                    "object_modified": "2026-09-26T05:10:12.058Z"
                },
                {
                    "object_ref": "relationship--efece3a8-02ba-45da-828e-383d31631c62",
                    "object_modified": "2026-04-29T14:23:06.251Z"
                },
                {
                    "object_ref": "relationship--eff95bb0-9681-47a6-a83d-efeb39328217",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--efface85-ce65-400f-8632-cb188cc08bcf",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f043ed4b-f304-44c4-8bf5-5a96ffeb97cd",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f05a2592-00f9-4f1f-ba55-395af5444b96",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f08d487a-7837-48f9-9301-fe0f9f144c92",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f0b2255d-2fa4-4b2a-a16b-77061243176e",
                    "object_modified": "2026-10-07T20:30:11.518Z"
                },
                {
                    "object_ref": "relationship--f0c81c9f-2fb7-4e7d-98ed-c75e3be7d962",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f0c8a954-c1a0-453a-9c1d-484305abdab2",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f0d4d23c-2c8c-4731-9b81-7c86fed25b5d",
                    "object_modified": "2026-04-29T14:23:06.252Z"
                },
                {
                    "object_ref": "relationship--f130282b-f681-455f-966b-55829842be92",
                    "object_modified": "2026-04-29T14:23:06.253Z"
                },
                {
                    "object_ref": "relationship--f13dac1a-090b-40c6-9093-eb4abe0deba8",
                    "object_modified": "2026-04-29T14:23:06.253Z"
                },
                {
                    "object_ref": "relationship--f14d1558-79b9-4fe4-8329-d26b19ef4ef8",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--f15f24d2-e581-46ce-83e4-a924f572aae6",
                    "object_modified": "2026-04-29T14:23:06.253Z"
                },
                {
                    "object_ref": "relationship--f1745073-e18e-4d62-b439-1afb1ec472c9",
                    "object_modified": "2026-04-29T14:23:06.253Z"
                },
                {
                    "object_ref": "relationship--f1bafa9d-986b-4d5c-b4c1-54aa3a7c4b91",
                    "object_modified": "2026-10-07T20:28:43.865Z"
                },
                {
                    "object_ref": "relationship--f1c35b0c-c465-4f20-801a-b9b1fb088d94",
                    "object_modified": "2026-04-29T14:23:06.254Z"
                },
                {
                    "object_ref": "relationship--f1edb034-6dc6-4d6c-8f75-e2cd12213704",
                    "object_modified": "2026-04-29T14:23:06.254Z"
                },
                {
                    "object_ref": "relationship--f20d8eed-b517-4297-b32a-9a5e0845de9f",
                    "object_modified": "2026-04-29T14:23:06.254Z"
                },
                {
                    "object_ref": "relationship--f25c2744-e08f-4ea2-83c3-46a517ba4f4d",
                    "object_modified": "2026-04-29T14:23:06.254Z"
                },
                {
                    "object_ref": "relationship--f29ecf69-1753-44bb-9b80-1025f49cadda",
                    "object_modified": "2026-04-29T14:23:06.255Z"
                },
                {
                    "object_ref": "relationship--f2a0fb2a-3630-49eb-912b-5ee04c8ad281",
                    "object_modified": "2026-10-07T21:55:56.264Z"
                },
                {
                    "object_ref": "relationship--f3178f64-d0e9-4cd0-84a4-0b28c0fde4bc",
                    "object_modified": "2026-04-29T14:23:06.255Z"
                },
                {
                    "object_ref": "relationship--f347b4fe-d829-427d-851a-fff3393441db",
                    "object_modified": "2026-04-29T14:23:06.256Z"
                },
                {
                    "object_ref": "relationship--f353e8ec-0766-4fbd-86b7-9ea06b52958b",
                    "object_modified": "2026-04-29T14:23:06.256Z"
                },
                {
                    "object_ref": "relationship--f3b158ac-205e-483c-9b18-c4725ce24411",
                    "object_modified": "2026-10-09T15:58:19.596Z"
                },
                {
                    "object_ref": "relationship--f3b3bc3c-8259-44f2-95f7-3f6d81714bcb",
                    "object_modified": "2026-09-25T19:14:00.633Z"
                },
                {
                    "object_ref": "relationship--f3dbd66f-cfdb-488e-924f-a5cdc27d3a11",
                    "object_modified": "2026-04-29T14:23:06.256Z"
                },
                {
                    "object_ref": "relationship--f3fab39f-864a-458a-b7dd-9ed38cfaa0e1",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f40cc6f5-111c-418f-aa84-50d920fa6c48",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f448969e-217d-4946-bede-6c85dc1b123f",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f45c2df8-30e7-45d0-8067-7b2870767574",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f497fd3e-8f05-4db2-97cc-48a8d35a8827",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f4b94abb-3b81-4c92-8bd1-0fed105ece14",
                    "object_modified": "2026-04-29T14:23:06.257Z"
                },
                {
                    "object_ref": "relationship--f4cae3bb-a699-43a6-9dae-fd3acac9551e",
                    "object_modified": "2026-04-29T14:23:06.258Z"
                },
                {
                    "object_ref": "relationship--f531e763-3550-40ba-a6a1-81e208ca12c6",
                    "object_modified": "2026-04-29T14:23:06.258Z"
                },
                {
                    "object_ref": "relationship--f5337891-61a3-4f24-a00a-8064a7ab4447",
                    "object_modified": "2026-04-29T14:23:06.258Z"
                },
                {
                    "object_ref": "relationship--f5621ad9-c905-42e3-b59b-e0ae7b9051c7",
                    "object_modified": "2026-04-29T14:23:06.258Z"
                },
                {
                    "object_ref": "relationship--f584a257-c22a-434b-aa2d-6220987821ab",
                    "object_modified": "2026-04-29T14:23:06.258Z"
                },
                {
                    "object_ref": "relationship--f5a50866-7b00-4e7c-936e-80c930d4f647",
                    "object_modified": "2026-10-07T21:21:31.153Z"
                },
                {
                    "object_ref": "relationship--f5c91d82-5f7c-4e40-a85a-4f1909ae5545",
                    "object_modified": "2026-04-29T14:23:06.259Z"
                },
                {
                    "object_ref": "relationship--f5e4f154-cb4a-4531-b63b-c55de7e3fcbb",
                    "object_modified": "2026-10-07T21:53:43.786Z"
                },
                {
                    "object_ref": "relationship--f61944a4-fef5-4989-bc3d-68f86e65d7d4",
                    "object_modified": "2026-09-03T20:28:49.125Z"
                },
                {
                    "object_ref": "relationship--f6320c84-adfe-4a26-b33c-2b29ebd1337f",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--f65823c1-211b-40bf-a622-407bb511cb3d",
                    "object_modified": "2026-04-29T14:23:06.260Z"
                },
                {
                    "object_ref": "relationship--f65a8ce8-90fa-4d92-a0dc-3ee544c541fe",
                    "object_modified": "2026-07-31T20:48:36.003Z"
                },
                {
                    "object_ref": "relationship--f65fa052-5ad0-4fc3-b579-ee33d1225659",
                    "object_modified": "2026-04-29T14:23:06.260Z"
                },
                {
                    "object_ref": "relationship--f6794183-bbc5-4c36-a597-fd49d4957c2b",
                    "object_modified": "2026-04-20T20:58:51.348Z"
                },
                {
                    "object_ref": "relationship--f67a26e8-4951-40e7-8016-cd066f39b75e",
                    "object_modified": "2026-10-07T21:23:00.753Z"
                },
                {
                    "object_ref": "relationship--f691dde5-bb2d-411b-a381-b33e0ab673d6",
                    "object_modified": "2026-04-29T14:23:06.260Z"
                },
                {
                    "object_ref": "relationship--f6bc7a24-c3e5-465c-ad71-52087cbff920",
                    "object_modified": "2026-04-29T14:23:06.260Z"
                },
                {
                    "object_ref": "relationship--f6e405c4-77e2-4bf3-8313-279aea9f0025",
                    "object_modified": "2026-04-29T14:23:06.260Z"
                },
                {
                    "object_ref": "relationship--f6f3d4ae-f58a-45bb-8c1e-712ac8c2073a",
                    "object_modified": "2026-10-07T21:55:05.985Z"
                },
                {
                    "object_ref": "relationship--f6ff74c2-d088-4252-a8e0-189574863765",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f703f8b2-b6b9-41f3-a551-6bb3647c45cc",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f710e99a-dfe9-4b2b-8b1b-97ab1c9d65f3",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f7215c1f-7bd7-41bd-8466-76caac225c7c",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f72a7a30-bab4-445b-b226-d5c3cd1a5846",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f76dd26b-2aa3-4fc3-bdef-ddd0632d851b",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f780259e-b2e6-4a65-ae54-1e6bb3e9e8dd",
                    "object_modified": "2026-10-07T21:14:49.409Z"
                },
                {
                    "object_ref": "relationship--f79d44ae-f971-484a-973b-e0cab972681d",
                    "object_modified": "2026-04-29T14:23:06.261Z"
                },
                {
                    "object_ref": "relationship--f7a466c2-acdf-49b1-9906-41388f7a5238",
                    "object_modified": "2026-04-29T14:23:06.262Z"
                },
                {
                    "object_ref": "relationship--f7c5bd1b-c596-41b2-b415-2bf5179667df",
                    "object_modified": "2026-08-04T20:48:45.205Z"
                },
                {
                    "object_ref": "relationship--f7c641d2-3528-4b4a-9612-85827eb0fff8",
                    "object_modified": "2026-07-31T20:48:13.585Z"
                },
                {
                    "object_ref": "relationship--f7d672f6-993b-4036-961d-f6e22e94446c",
                    "object_modified": "2026-04-29T14:23:06.262Z"
                },
                {
                    "object_ref": "relationship--f82c15ca-be3c-40f8-933b-6c8fee799ebd",
                    "object_modified": "2026-10-07T20:28:33.529Z"
                },
                {
                    "object_ref": "relationship--f8318ac4-8ed0-478d-be87-faa2c9d8a740",
                    "object_modified": "2026-07-31T20:48:36.011Z"
                },
                {
                    "object_ref": "relationship--f8456c9b-a4a5-4f13-94e3-54c787b21089",
                    "object_modified": "2026-09-03T20:28:49.136Z"
                },
                {
                    "object_ref": "relationship--f8578dec-7c78-4af3-b62f-4f305bd991bb",
                    "object_modified": "2026-09-26T05:31:21.853Z"
                },
                {
                    "object_ref": "relationship--f862418a-e7b4-4783-8949-7145f3dee665",
                    "object_modified": "2026-04-29T14:23:06.262Z"
                },
                {
                    "object_ref": "relationship--f86bc28e-6293-411e-8bbe-2e2717286529",
                    "object_modified": "2026-04-29T14:23:06.262Z"
                },
                {
                    "object_ref": "relationship--f86bde61-c4ec-4d40-9768-32e9b52c1702",
                    "object_modified": "2026-04-29T14:23:06.263Z"
                },
                {
                    "object_ref": "relationship--f8c77472-9a3a-4d2b-8a04-c7c6deee7e34",
                    "object_modified": "2026-10-07T20:07:43.817Z"
                },
                {
                    "object_ref": "relationship--f9164f95-51d4-4b6c-92d8-0cafe4b97e6c",
                    "object_modified": "2026-09-03T20:30:36.768Z"
                },
                {
                    "object_ref": "relationship--f92764db-a880-4726-9d28-a035170f790c",
                    "object_modified": "2026-04-29T14:23:06.263Z"
                },
                {
                    "object_ref": "relationship--f9907fb1-976b-4f51-ac13-b45f2ff9452b",
                    "object_modified": "2026-04-29T14:23:06.264Z"
                },
                {
                    "object_ref": "relationship--f9aa3364-a1eb-4776-ae03-c39b250545a0",
                    "object_modified": "2026-04-29T14:23:06.264Z"
                },
                {
                    "object_ref": "relationship--f9c29dd4-1c5e-4f7e-b60a-862319a6d0a0",
                    "object_modified": "2026-04-29T14:23:06.264Z"
                },
                {
                    "object_ref": "relationship--f9e33311-f162-4ebd-b944-8704f6dc0fd4",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--f9ee9476-5487-4535-93fd-6b0cbbda0471",
                    "object_modified": "2026-04-29T14:23:06.264Z"
                },
                {
                    "object_ref": "relationship--fa1bde35-63d9-4c5c-969b-2c17c29089fa",
                    "object_modified": "2026-04-29T14:23:06.264Z"
                },
                {
                    "object_ref": "relationship--fa391554-a3c0-4b89-9083-a53d299c5fad",
                    "object_modified": "2026-04-29T14:23:06.265Z"
                },
                {
                    "object_ref": "relationship--faa5ba6b-bbc4-47ab-a737-6dc1d8b31efd",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--fac4bc88-af9b-4eec-b041-e4138b49c3c0",
                    "object_modified": "2026-09-03T20:30:36.781Z"
                },
                {
                    "object_ref": "relationship--fad25140-73de-40d5-a010-3464188db973",
                    "object_modified": "2026-04-29T14:23:06.265Z"
                },
                {
                    "object_ref": "relationship--fadbdca3-3c98-497c-a156-e53b89664359",
                    "object_modified": "2026-04-29T14:23:06.266Z"
                },
                {
                    "object_ref": "relationship--fadc8348-837b-4d7d-91a2-679117e5fd7b",
                    "object_modified": "2026-07-31T20:48:20.120Z"
                },
                {
                    "object_ref": "relationship--faf163b6-4e35-43d6-9c0c-83d91d215854",
                    "object_modified": "2026-04-29T14:23:06.266Z"
                },
                {
                    "object_ref": "relationship--fb4c7d03-e05e-407f-b9ed-5cfd2f446ad4",
                    "object_modified": "2026-10-07T20:11:23.757Z"
                },
                {
                    "object_ref": "relationship--fb4ee993-feb0-414f-b724-6ba392b1e560",
                    "object_modified": "2026-04-29T14:23:06.266Z"
                },
                {
                    "object_ref": "relationship--fb8530c7-b6d7-44be-851e-1eb773f47e72",
                    "object_modified": "2026-04-29T14:23:06.266Z"
                },
                {
                    "object_ref": "relationship--fbeb6178-0a13-4573-bb74-7d2e5a2fe082",
                    "object_modified": "2026-10-07T21:45:04.555Z"
                },
                {
                    "object_ref": "relationship--fc02e858-0e4d-462c-8f66-f7289677c559",
                    "object_modified": "2026-04-29T14:23:06.267Z"
                },
                {
                    "object_ref": "relationship--fc189fa0-1235-46ac-a802-f226dc0ec4e1",
                    "object_modified": "2026-09-03T20:28:49.151Z"
                },
                {
                    "object_ref": "relationship--fc3a187f-7437-413f-bea4-14936ce86512",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "relationship--fc4803cb-d6bf-4674-bf40-d4b0997824ba",
                    "object_modified": "2026-07-31T20:48:28.016Z"
                },
                {
                    "object_ref": "relationship--fc508fcc-6f19-44da-bbc0-de6aaa627d04",
                    "object_modified": "2026-04-29T14:23:06.267Z"
                },
                {
                    "object_ref": "relationship--fc77a4bc-1383-492a-a04b-9062345ced53",
                    "object_modified": "2026-04-29T14:23:06.267Z"
                },
                {
                    "object_ref": "relationship--fc8e2629-c7ea-4b3c-b614-edde1a700f27",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fc9e2b69-f0f6-4279-ab07-ea18eef19740",
                    "object_modified": "2026-09-25T20:35:14.655Z"
                },
                {
                    "object_ref": "relationship--fcb02e3f-3a41-46fc-8014-f1e95b14e28a",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcb7733f-553d-43de-a8c6-c85a5cd65041",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcba6a58-72b0-4d54-a887-740624e22f6f",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcc33052-42c2-485c-903c-cd86e5a87f34",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcd3fdbf-4909-48ab-85c4-ce4b34172eb0",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcd7c2bf-638e-409f-bc36-fff28c3cc68f",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fcdf1912-dfc8-4cc3-92de-c6689353dd8e",
                    "object_modified": "2026-04-29T14:23:06.268Z"
                },
                {
                    "object_ref": "relationship--fd1bde9f-b2a5-48e2-ac92-cb6097040a71",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fd1f3d4e-825f-4b25-aaf7-c82823ccf341",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fd309395-8fcc-402c-9227-90ac897fd602",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fd3bc308-82cd-49c9-a41e-9b19ce04b3cd",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fd52f382-115f-483a-82c1-bb31fe5d5eb6",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fd8cd074-9e66-45f3-b41f-71f7aaf00ee6",
                    "object_modified": "2026-04-29T14:23:06.269Z"
                },
                {
                    "object_ref": "relationship--fdc20415-c9a1-405e-80af-3d297894e8fa",
                    "object_modified": "2026-04-29T14:23:06.270Z"
                },
                {
                    "object_ref": "relationship--fe19d9d1-a560-425d-a41a-a643199aa79b",
                    "object_modified": "2026-07-31T20:48:57.009Z"
                },
                {
                    "object_ref": "relationship--fe22f626-ddf3-4d5e-97d1-058878d7830f",
                    "object_modified": "2026-09-03T20:30:36.798Z"
                },
                {
                    "object_ref": "relationship--fe265dd7-2c1a-4c75-8aa8-12d0c82c7926",
                    "object_modified": "2026-04-29T14:23:06.270Z"
                },
                {
                    "object_ref": "relationship--fe3bd9f0-2cdb-420d-88fa-352125bd7f28",
                    "object_modified": "2026-04-29T14:23:06.270Z"
                },
                {
                    "object_ref": "relationship--feb32f07-00f0-404f-920d-8891be40b655",
                    "object_modified": "2026-04-29T14:23:06.271Z"
                },
                {
                    "object_ref": "relationship--ff021e27-63be-41f4-bc4d-2ce75d8a3ecb",
                    "object_modified": "2026-04-29T14:23:06.271Z"
                },
                {
                    "object_ref": "relationship--ff107632-751b-4efb-86bd-af670b48d35d",
                    "object_modified": "2026-04-29T14:23:06.271Z"
                },
                {
                    "object_ref": "relationship--ff3f0668-98df-44c1-88c2-711f05720eb8",
                    "object_modified": "2026-04-29T14:23:06.271Z"
                },
                {
                    "object_ref": "relationship--ff63658f-6d46-48b4-b524-d02dd715be42",
                    "object_modified": "2026-09-26T04:58:54.550Z"
                },
                {
                    "object_ref": "relationship--ffc5bbce-8d9c-4276-9dc6-efed5c01af8b",
                    "object_modified": "2026-09-03T20:31:39.387Z"
                },
                {
                    "object_ref": "relationship--ffd2ae1d-6c1d-4d27-8cf0-bc745100bba7",
                    "object_modified": "2026-04-29T14:23:06.272Z"
                },
                {
                    "object_ref": "x-mitre-analytic--0099659c-6a20-4331-9d47-b1c0c380fd6b",
                    "object_modified": "2026-10-13T17:47:43.395Z"
                },
                {
                    "object_ref": "x-mitre-analytic--01d1755a-23ba-45d4-9cb9-00a7343d0da5",
                    "object_modified": "2026-10-13T17:47:32.603Z"
                },
                {
                    "object_ref": "x-mitre-analytic--02172ea8-2b1a-41ec-a8d6-96b57ff9db9f",
                    "object_modified": "2026-09-26T02:41:25.738Z"
                },
                {
                    "object_ref": "x-mitre-analytic--02e631a3-5ef0-436d-89bc-923fb32b80f0",
                    "object_modified": "2026-10-13T17:45:35.993Z"
                },
                {
                    "object_ref": "x-mitre-analytic--03e474c2-49ff-4126-9a9a-e1f196d4a97b",
                    "object_modified": "2026-10-13T17:46:40.560Z"
                },
                {
                    "object_ref": "x-mitre-analytic--04d594f0-5158-4965-a81d-f757f841bbe1",
                    "object_modified": "2026-10-13T17:47:09.902Z"
                },
                {
                    "object_ref": "x-mitre-analytic--058d856a-6356-402f-b3ff-a7c1b6186921",
                    "object_modified": "2026-10-13T17:47:33.082Z"
                },
                {
                    "object_ref": "x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8",
                    "object_modified": "2026-10-13T17:45:23.517Z"
                },
                {
                    "object_ref": "x-mitre-analytic--05e52883-89d1-43f9-9836-d0dfc2f1d3e3",
                    "object_modified": "2026-10-13T17:47:00.577Z"
                },
                {
                    "object_ref": "x-mitre-analytic--060b84bc-0f25-4643-aa26-f98f32e6a860",
                    "object_modified": "2026-10-13T17:45:12.847Z"
                },
                {
                    "object_ref": "x-mitre-analytic--073153c5-a2dc-4985-b5f0-b0ee35f5457c",
                    "object_modified": "2026-10-13T17:45:38.485Z"
                },
                {
                    "object_ref": "x-mitre-analytic--0a622741-8425-4d8a-8e04-4631a7e049bf",
                    "object_modified": "2026-09-25T20:40:41.056Z"
                },
                {
                    "object_ref": "x-mitre-analytic--0aa3c64b-e708-4fe2-9764-af61670e1172",
                    "object_modified": "2026-10-13T17:44:28.398Z"
                },
                {
                    "object_ref": "x-mitre-analytic--0b4e7cfa-9f9d-49b0-b5bf-afdf62058c5a",
                    "object_modified": "2026-10-13T17:47:22.362Z"
                },
                {
                    "object_ref": "x-mitre-analytic--0d570cdf-f503-43b1-a3be-5ee485379576",
                    "object_modified": "2026-10-05T22:50:12.793Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1017530e-423d-4857-80b6-99891bf82d28",
                    "object_modified": "2026-10-13T17:47:34.740Z"
                },
                {
                    "object_ref": "x-mitre-analytic--11a350cf-1ea0-4065-877b-c3bb410bf3a0",
                    "object_modified": "2026-10-13T17:46:29.860Z"
                },
                {
                    "object_ref": "x-mitre-analytic--13b48db7-e4d4-47a3-8bd1-60f9c2a039da",
                    "object_modified": "2026-10-13T17:44:54.658Z"
                },
                {
                    "object_ref": "x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419",
                    "object_modified": "2026-10-13T17:47:36.018Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1532258f-43d7-41e9-ad80-aac5abdfcdc3",
                    "object_modified": "2026-10-07T13:21:45.013Z"
                },
                {
                    "object_ref": "x-mitre-analytic--154de82d-e589-4dab-ae2a-42a61dc1443a",
                    "object_modified": "2026-10-13T17:47:56.547Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1672d2e3-8756-4380-b22c-517aa9f1cce0",
                    "object_modified": "2026-10-13T17:45:26.194Z"
                },
                {
                    "object_ref": "x-mitre-analytic--16dcc866-c1fc-4616-b985-235197cae399",
                    "object_modified": "2026-10-13T17:47:52.823Z"
                },
                {
                    "object_ref": "x-mitre-analytic--175f3f34-38ad-41ad-ae95-927479eacc14",
                    "object_modified": "2026-10-13T17:46:31.857Z"
                },
                {
                    "object_ref": "x-mitre-analytic--17713d7e-3d88-47b0-b5b0-fd60cd90bf86",
                    "object_modified": "2026-10-13T17:45:51.944Z"
                },
                {
                    "object_ref": "x-mitre-analytic--18409dae-85cb-4460-a2a6-f287991f0dca",
                    "object_modified": "2026-10-13T17:45:04.204Z"
                },
                {
                    "object_ref": "x-mitre-analytic--18bf81d6-981c-49a2-9259-a08e1f1337b8",
                    "object_modified": "2026-10-13T17:45:14.299Z"
                },
                {
                    "object_ref": "x-mitre-analytic--197be8a2-8569-4304-9fe8-b987c8ed79b1",
                    "object_modified": "2026-10-13T17:45:30.374Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1be515a0-2656-4b35-a561-e8157169350d",
                    "object_modified": "2026-10-13T17:46:11.613Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1e9c5d46-14e2-4efc-8861-e6dc942b3b9c",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--1f5ec3e0-2b7d-4b6d-992b-c5849911df1e",
                    "object_modified": "2026-10-13T17:44:29.546Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2195ec67-7cea-4b0d-a678-18384089bf2c",
                    "object_modified": "2026-10-13T17:44:04.902Z"
                },
                {
                    "object_ref": "x-mitre-analytic--21e2074e-f7d9-4a41-87e6-d365ac99a972",
                    "object_modified": "2026-10-13T17:47:11.077Z"
                },
                {
                    "object_ref": "x-mitre-analytic--22252671-e8e9-4853-8696-7a38ec7bad53",
                    "object_modified": "2026-10-13T17:46:58.661Z"
                },
                {
                    "object_ref": "x-mitre-analytic--22b202f2-d4dd-44dd-b5e1-791ff2aef8ed",
                    "object_modified": "2026-10-13T17:47:08.790Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2388dc31-ba9a-4c12-b4b9-28bbc981c73e",
                    "object_modified": "2026-10-13T17:45:31.039Z"
                },
                {
                    "object_ref": "x-mitre-analytic--23ce0ac3-6afe-4647-be72-e1e9bcd1490e",
                    "object_modified": "2026-10-13T17:47:53.370Z"
                },
                {
                    "object_ref": "x-mitre-analytic--23d4c3a3-a195-4d5f-a5c5-ae4d23054ee4",
                    "object_modified": "2026-10-13T17:47:40.158Z"
                },
                {
                    "object_ref": "x-mitre-analytic--23eb2bc3-735d-4425-96e1-f9d3a1453bfa",
                    "object_modified": "2026-10-13T17:46:18.931Z"
                },
                {
                    "object_ref": "x-mitre-analytic--27e8a172-0682-4d23-a7c2-e2eac526ea9c",
                    "object_modified": "2026-10-13T17:46:46.388Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2862e391-b78a-400f-819e-d44e672e3d3a",
                    "object_modified": "2026-10-13T17:46:01.858Z"
                },
                {
                    "object_ref": "x-mitre-analytic--28eb77c1-1834-4b7a-a06f-afebb7f2e756",
                    "object_modified": "2026-10-13T17:47:57.089Z"
                },
                {
                    "object_ref": "x-mitre-analytic--29b6e4b8-878c-4139-aa56-7e1513714d34",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2a89e23c-fb19-456c-bf77-db29bc673301",
                    "object_modified": "2026-10-13T17:46:05.565Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2b726f82-bb4f-4889-b6a0-4587f438cd83",
                    "object_modified": "2026-10-13T17:45:19.389Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2b751a3d-c680-46c9-b92b-55a9d24bd4f9",
                    "object_modified": "2026-10-13T17:44:01.245Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2c7a6c0b-55f7-44d1-a605-bf2dd1dee01a",
                    "object_modified": "2026-10-13T17:44:23.746Z"
                },
                {
                    "object_ref": "x-mitre-analytic--2d784f76-a3e0-46ed-8ce2-d9dcd531fa52",
                    "object_modified": "2026-10-13T17:47:01.490Z"
                },
                {
                    "object_ref": "x-mitre-analytic--301b9d5c-6bcd-4539-9ace-6ae4c5d94c43",
                    "object_modified": "2026-10-13T17:45:44.208Z"
                },
                {
                    "object_ref": "x-mitre-analytic--302a5327-70cf-44b5-b592-ce9a62014dcc",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--322ac45b-d540-4d2a-84a1-cde200238b95",
                    "object_modified": "2026-10-13T17:47:40.667Z"
                },
                {
                    "object_ref": "x-mitre-analytic--32bfb2ab-2ad1-4c00-8428-96bc626c34f3",
                    "object_modified": "2026-10-13T17:46:15.236Z"
                },
                {
                    "object_ref": "x-mitre-analytic--32db74f9-d46d-4728-891a-113a8b8e2b07",
                    "object_modified": "2026-10-13T17:47:20.792Z"
                },
                {
                    "object_ref": "x-mitre-analytic--330166da-bc80-4aca-bd41-cbd6b1742812",
                    "object_modified": "2026-10-13T17:45:49.005Z"
                },
                {
                    "object_ref": "x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4",
                    "object_modified": "2026-10-13T17:45:06.815Z"
                },
                {
                    "object_ref": "x-mitre-analytic--346fbf4f-5fc5-4acb-9d2f-cd30c3c22226",
                    "object_modified": "2026-10-13T17:44:44.076Z"
                },
                {
                    "object_ref": "x-mitre-analytic--354b93da-06e9-4634-a5fd-7f9b7b3a9d5a",
                    "object_modified": "2026-10-13T17:46:22.866Z"
                },
                {
                    "object_ref": "x-mitre-analytic--35b0fba9-70c7-420b-a9eb-b3caf6b9d87e",
                    "object_modified": "2026-10-13T17:44:58.977Z"
                },
                {
                    "object_ref": "x-mitre-analytic--35c7f7bd-a79b-4125-ba0c-2bbf281ebf51",
                    "object_modified": "2026-10-13T17:44:50.784Z"
                },
                {
                    "object_ref": "x-mitre-analytic--37d989e6-14cd-49a4-adec-3d8b72c8dc22",
                    "object_modified": "2026-10-13T17:44:04.143Z"
                },
                {
                    "object_ref": "x-mitre-analytic--383a1a1c-8ecf-4909-9237-14a1f4fc4179",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--392fc0ea-dcf5-40cd-81ce-df2a9b90f8cc",
                    "object_modified": "2026-10-13T17:46:22.357Z"
                },
                {
                    "object_ref": "x-mitre-analytic--393d7e7b-0790-49e7-9bcd-87ab4662b05e",
                    "object_modified": "2026-10-13T17:44:19.350Z"
                },
                {
                    "object_ref": "x-mitre-analytic--39f27e29-f5cc-4bb8-b1d5-5e55c1a4688e",
                    "object_modified": "2026-10-05T19:35:09.853Z"
                },
                {
                    "object_ref": "x-mitre-analytic--39fb5809-408b-4f42-a26f-92d372d1a041",
                    "object_modified": "2026-10-13T17:45:42.325Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3a8c6bca-bc2c-4a70-9446-8b2adca39441",
                    "object_modified": "2026-10-13T17:48:02.706Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3c6a21cb-8643-41bc-94a1-e860b02a1cad",
                    "object_modified": "2026-10-13T17:47:05.430Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3c6aa6f7-29e9-41d9-8500-30b6d0533d64",
                    "object_modified": "2026-10-13T17:44:07.110Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3e456d4d-397d-4e04-9261-9399960c9633",
                    "object_modified": "2026-10-13T17:47:47.678Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3f052beb-d384-4ebe-b942-2c4ddeb95833",
                    "object_modified": "2026-10-13T17:46:09.218Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3f10ffe9-fa73-4aeb-bf98-322831bf757f",
                    "object_modified": "2026-10-13T17:44:00.393Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3fdeb2a5-e60c-4fac-b003-528676da2f05",
                    "object_modified": "2026-10-13T17:44:51.977Z"
                },
                {
                    "object_ref": "x-mitre-analytic--3fef48cc-6e1f-4a2f-9a1e-a8a0e43c3c20",
                    "object_modified": "2026-10-05T19:23:47.307Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4053f72d-59c0-432e-a969-83217c586338",
                    "object_modified": "2026-10-13T17:47:04.076Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4062a3b7-6859-4b28-b0d3-b0f71dc62f6a",
                    "object_modified": "2026-10-13T17:47:07.448Z"
                },
                {
                    "object_ref": "x-mitre-analytic--45c339b2-55b1-4a8b-b21d-c53c3bf2b73a",
                    "object_modified": "2026-10-13T17:46:32.676Z"
                },
                {
                    "object_ref": "x-mitre-analytic--46022e9c-fcb9-4369-b953-ad5724a6819b",
                    "object_modified": "2026-10-13T17:45:11.655Z"
                },
                {
                    "object_ref": "x-mitre-analytic--46604667-aba2-403a-b41b-6e5a9f1494da",
                    "object_modified": "2026-10-13T17:44:14.649Z"
                },
                {
                    "object_ref": "x-mitre-analytic--47aafd6b-75d1-44e9-b2bc-505d9fbb4671",
                    "object_modified": "2026-10-13T17:44:27.280Z"
                },
                {
                    "object_ref": "x-mitre-analytic--482edcb0-46cd-45b6-a373-2e9bbe2ffad2",
                    "object_modified": "2026-10-13T17:47:02.412Z"
                },
                {
                    "object_ref": "x-mitre-analytic--484023ea-6fea-4f91-b40d-c6d87188cbfe",
                    "object_modified": "2026-10-13T17:46:17.221Z"
                },
                {
                    "object_ref": "x-mitre-analytic--48d2023b-469d-4f9f-a4e6-010be72436b9",
                    "object_modified": "2026-10-13T17:46:29.074Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4984e65d-1bb6-4de1-8dfc-5672e822bb47",
                    "object_modified": "2026-10-13T17:47:45.412Z"
                },
                {
                    "object_ref": "x-mitre-analytic--49d64aa5-8804-45c9-99d9-b0729f3dc58c",
                    "object_modified": "2026-10-13T17:46:13.532Z"
                },
                {
                    "object_ref": "x-mitre-analytic--49d68949-cdc8-4364-9700-7786f4d08871",
                    "object_modified": "2026-10-13T17:46:11.116Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4a1b6793-4389-40f7-a7d3-8ad98cba738e",
                    "object_modified": "2026-10-13T17:46:52.508Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4be2c353-ef8d-4bb4-b973-4cae602f627f",
                    "object_modified": "2026-10-13T17:44:34.793Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4e176b16-f17b-47dc-81a3-6a254edb1b50",
                    "object_modified": "2026-10-13T13:31:24.947Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4ea5942d-fa95-484d-9acb-fe205a3960a3",
                    "object_modified": "2026-10-13T17:46:43.463Z"
                },
                {
                    "object_ref": "x-mitre-analytic--4effd386-490e-435b-9375-f53a3b44f0d0",
                    "object_modified": "2026-10-13T17:46:48.044Z"
                },
                {
                    "object_ref": "x-mitre-analytic--500aec57-cf41-4572-bdae-f08e185ebeec",
                    "object_modified": "2026-10-13T17:46:51.696Z"
                },
                {
                    "object_ref": "x-mitre-analytic--50e94b5a-3b2b-450d-a33c-c6b0d72f7b50",
                    "object_modified": "2026-10-05T19:28:20.669Z"
                },
                {
                    "object_ref": "x-mitre-analytic--518d0e1a-b5e2-4c12-a36c-8d61ad58955e",
                    "object_modified": "2026-10-13T17:47:16.047Z"
                },
                {
                    "object_ref": "x-mitre-analytic--51a094bf-b7eb-452a-9b7a-ffac16fce1ac",
                    "object_modified": "2026-10-13T17:48:00.318Z"
                },
                {
                    "object_ref": "x-mitre-analytic--51c17c6d-d4f7-46f6-840e-3697b33d2783",
                    "object_modified": "2026-10-13T17:47:55.679Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5330f4ab-a6f0-411d-957d-bb7bd2a73ddf",
                    "object_modified": "2026-10-13T17:46:36.923Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5346fb44-b04e-4820-8b14-eb62ee3a2ca8",
                    "object_modified": "2026-10-13T17:46:01.007Z"
                },
                {
                    "object_ref": "x-mitre-analytic--55544bb8-440f-4b67-aa35-7e7af5952aca",
                    "object_modified": "2026-10-13T17:47:26.656Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5610211c-1458-4333-8640-384189d9318e",
                    "object_modified": "2026-10-13T17:44:56.723Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5ac739da-7adb-491a-8ef9-694846572fc1",
                    "object_modified": "2026-10-13T17:46:38.571Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5b7ee346-9061-4e8e-9bec-4d629cf488c5",
                    "object_modified": "2026-10-13T17:48:05.156Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5cf9cf41-4419-4d04-afcd-991dff638faf",
                    "object_modified": "2026-10-13T17:44:12.730Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5db2235a-aa06-47b7-a89e-953a5afb6555",
                    "object_modified": "2026-10-13T17:45:10.431Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5e0fd666-e460-4627-83ef-f7390752692e",
                    "object_modified": "2026-09-26T03:28:48.088Z"
                },
                {
                    "object_ref": "x-mitre-analytic--5f4e48bc-ac0a-4a86-8d59-229105b212ca",
                    "object_modified": "2026-10-13T17:46:49.771Z"
                },
                {
                    "object_ref": "x-mitre-analytic--613b28ef-88dd-4008-8d7e-206ce55a7cde",
                    "object_modified": "2026-10-13T17:45:44.737Z"
                },
                {
                    "object_ref": "x-mitre-analytic--61dac9fe-69e8-40df-b573-e1eebff4cfc1",
                    "object_modified": "2026-10-13T17:44:37.170Z"
                },
                {
                    "object_ref": "x-mitre-analytic--62dee878-27af-4620-b710-10b0ca373701",
                    "object_modified": "2026-10-13T17:43:58.772Z"
                },
                {
                    "object_ref": "x-mitre-analytic--62ef9334-2cb2-436d-bd50-2ae1213704aa",
                    "object_modified": "2026-10-13T17:44:48.471Z"
                },
                {
                    "object_ref": "x-mitre-analytic--62facfaa-0d19-4479-8cd7-cfef4c30898c",
                    "object_modified": "2026-10-13T17:45:08.047Z"
                },
                {
                    "object_ref": "x-mitre-analytic--636e612f-0b63-44e8-bf2c-31b62d20508b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6549a8ab-c92c-4249-a5f2-cd9d0458192d",
                    "object_modified": "2026-10-13T17:45:57.863Z"
                },
                {
                    "object_ref": "x-mitre-analytic--65f5991b-df5e-4364-a579-e1ea5022a725",
                    "object_modified": "2026-10-05T19:44:49.870Z"
                },
                {
                    "object_ref": "x-mitre-analytic--66070162-d51e-46e7-8d32-2140fd5e7086",
                    "object_modified": "2026-10-13T17:44:44.933Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6623745b-ae70-491c-a317-8206b4789463",
                    "object_modified": "2026-10-13T17:46:41.801Z"
                },
                {
                    "object_ref": "x-mitre-analytic--66c22dd3-7665-4ead-ab01-5a4742c37d8b",
                    "object_modified": "2026-10-13T17:47:03.248Z"
                },
                {
                    "object_ref": "x-mitre-analytic--67861309-0ba7-4713-843e-3def87e396ec",
                    "object_modified": "2026-10-13T17:45:53.254Z"
                },
                {
                    "object_ref": "x-mitre-analytic--68073351-4e4f-40e4-9394-a9166bb346d7",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6829c203-6543-4489-bab8-422a41ac82a1",
                    "object_modified": "2026-10-13T17:45:32.900Z"
                },
                {
                    "object_ref": "x-mitre-analytic--684fc82e-39d7-48c8-9123-5badd99afaa7",
                    "object_modified": "2026-10-13T17:46:47.205Z"
                },
                {
                    "object_ref": "x-mitre-analytic--695ad38a-7e5b-4d91-bab3-2388d3ae2f0b",
                    "object_modified": "2026-10-13T17:45:34.059Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6a510bf0-0289-4eb0-8645-89f0f4d32cf3",
                    "object_modified": "2026-10-13T17:47:59.527Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6b3b3e92-bef7-4977-9895-29036bab29f1",
                    "object_modified": "2026-10-13T17:47:46.090Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6c7a03f0-1697-4109-9b8c-70567ed5eaf4",
                    "object_modified": "2026-10-13T17:47:28.536Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6e046c4c-6c93-4fdf-a69e-5d81b52d1e9c",
                    "object_modified": "2026-10-13T17:47:46.920Z"
                },
                {
                    "object_ref": "x-mitre-analytic--6e73b9c1-482d-44c7-b25b-e9b99764e987",
                    "object_modified": "2026-10-13T17:44:42.861Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7107739b-92d2-41fa-9fc8-ebe72f6086ee",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--736619f9-f636-4308-843b-83d38813982b",
                    "object_modified": "2026-10-13T17:45:50.847Z"
                },
                {
                    "object_ref": "x-mitre-analytic--74ac7748-3b80-4aac-ad25-c3e6914cb01a",
                    "object_modified": "2026-10-13T17:47:11.946Z"
                },
                {
                    "object_ref": "x-mitre-analytic--74cb9e26-6ec1-41e8-9da8-ed30504f9c39",
                    "object_modified": "2026-10-13T17:46:16.686Z"
                },
                {
                    "object_ref": "x-mitre-analytic--74e60460-7618-4a7c-b490-c1e164784564",
                    "object_modified": "2026-10-13T17:47:17.766Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7535c7b7-3046-44f2-b2ec-4faea6c5a21b",
                    "object_modified": "2026-10-05T19:45:49.464Z"
                },
                {
                    "object_ref": "x-mitre-analytic--76f95bb8-16c3-42f7-99a0-929e6f08a24e",
                    "object_modified": "2026-10-13T17:47:58.200Z"
                },
                {
                    "object_ref": "x-mitre-analytic--77857bc3-6a38-4826-8109-30facf6c23ec",
                    "object_modified": "2026-10-13T17:46:27.401Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7841eb6b-8a05-4754-b738-a475bfbb89fb",
                    "object_modified": "2026-10-13T17:46:53.888Z"
                },
                {
                    "object_ref": "x-mitre-analytic--78615cd7-6a14-4921-aaa9-2aae0774f0f1",
                    "object_modified": "2026-10-13T17:46:20.438Z"
                },
                {
                    "object_ref": "x-mitre-analytic--791310ad-7db5-41df-9fa5-fa4097d8a51d",
                    "object_modified": "2026-10-13T17:47:23.840Z"
                },
                {
                    "object_ref": "x-mitre-analytic--792af2a0-7fc2-4b63-899e-ae09dea3aef1",
                    "object_modified": "2026-10-13T17:44:20.394Z"
                },
                {
                    "object_ref": "x-mitre-analytic--795181c0-57b0-4c2f-ac9a-1c6a1c62b813",
                    "object_modified": "2026-10-13T17:46:06.366Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7aa60595-5a1c-4de2-be60-cc1f9fea2313",
                    "object_modified": "2026-10-13T17:47:48.446Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7b5121f9-506c-40bf-81b2-df1042aa48b7",
                    "object_modified": "2026-10-13T17:46:53.325Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7d81a83b-ae31-4ceb-b469-bb8a914a751c",
                    "object_modified": "2026-10-13T17:45:58.659Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7d922eff-22d6-4ac2-90d9-3539e0c998fe",
                    "object_modified": "2026-10-13T17:47:39.319Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7ddbb1f7-feda-4a50-b944-b02bedf653b5",
                    "object_modified": "2026-10-13T17:45:18.257Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7e96cc61-f4ca-4546-8631-3ef6fff8ae28",
                    "object_modified": "2026-10-13T17:45:21.764Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7ec4b791-7054-442f-8967-6d6fa5e8678b",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--7f685d48-0d80-4ba4-8473-432c31b21da8",
                    "object_modified": "2026-10-13T17:44:47.309Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8428e0cd-009e-41c1-8292-88651d4486c9",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--856d21f6-edc1-4e7b-84c5-692a467a2dbe",
                    "object_modified": "2026-10-13T17:48:06.012Z"
                },
                {
                    "object_ref": "x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1",
                    "object_modified": "2026-10-13T17:47:41.828Z"
                },
                {
                    "object_ref": "x-mitre-analytic--86989bf4-0dfc-459e-aa67-86c9c02fcdf9",
                    "object_modified": "2026-10-13T17:44:40.273Z"
                },
                {
                    "object_ref": "x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f",
                    "object_modified": "2026-10-13T17:47:34.226Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8713afc6-95d2-4064-a047-a9be0cc486dd",
                    "object_modified": "2026-10-13T17:45:00.155Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8744740c-e346-4a34-b0db-9c5540e65ed7",
                    "object_modified": "2026-10-13T17:47:14.733Z"
                },
                {
                    "object_ref": "x-mitre-analytic--87efd969-d991-49be-9e41-24f5dbcff9e8",
                    "object_modified": "2026-10-13T17:47:42.651Z"
                },
                {
                    "object_ref": "x-mitre-analytic--87f5d864-d79b-474a-a3b4-43673dcb9f90",
                    "object_modified": "2026-10-13T17:47:31.506Z"
                },
                {
                    "object_ref": "x-mitre-analytic--880a1133-6639-42f0-96a8-3e914426d38b",
                    "object_modified": "2026-10-13T17:44:02.622Z"
                },
                {
                    "object_ref": "x-mitre-analytic--882f2365-4c14-4c48-8eef-2a7c293c8569",
                    "object_modified": "2026-10-13T17:44:06.365Z"
                },
                {
                    "object_ref": "x-mitre-analytic--88dc7850-3f62-4822-90c0-3a1ed06cc044",
                    "object_modified": "2026-10-13T17:46:35.838Z"
                },
                {
                    "object_ref": "x-mitre-analytic--899d0dce-64f7-4924-93a1-8e3c83dd510f",
                    "object_modified": "2026-10-13T17:45:26.988Z"
                },
                {
                    "object_ref": "x-mitre-analytic--899d41e8-8d02-45f9-ab8a-3a06f4cc4189",
                    "object_modified": "2026-10-13T17:47:06.181Z"
                },
                {
                    "object_ref": "x-mitre-analytic--89b7a519-ee8c-4aac-a9ef-f82d32116d30",
                    "object_modified": "2026-10-13T17:47:59.034Z"
                },
                {
                    "object_ref": "x-mitre-analytic--89ca8617-20fd-404b-9afb-dcfd2684a791",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8aac97f9-602a-440f-b846-7a11e6a157ca",
                    "object_modified": "2026-10-13T17:44:33.568Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8b7ed6ba-ae88-48ab-8aa1-48c15e23db4d",
                    "object_modified": "2026-10-13T17:44:38.338Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8c1a6dd8-6706-44cb-93b1-c29491ab9702",
                    "object_modified": "2026-10-05T19:35:09.854Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8c77f31f-c6f4-491c-965a-e25c506b0c68",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8c95b5df-75bb-4fea-8a3e-a6b9f2ddf64e",
                    "object_modified": "2026-09-25T17:56:20.295Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8cf7c363-594f-4efc-a1e8-30435b5f1feb",
                    "object_modified": "2026-10-13T17:45:20.575Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8d30e2a3-b7a5-403b-ad5f-243f37f44fa4",
                    "object_modified": "2026-10-13T17:45:48.528Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8e055360-9991-43ef-bd20-2b3f40432c78",
                    "object_modified": "2026-10-13T17:47:36.850Z"
                },
                {
                    "object_ref": "x-mitre-analytic--8f09d2c6-0a02-486f-b468-f1e9519c35c7",
                    "object_modified": "2026-10-13T17:46:14.348Z"
                },
                {
                    "object_ref": "x-mitre-analytic--908fe88b-d8e2-47d1-b6a4-7a42b3bbe09b",
                    "object_modified": "2026-10-13T17:45:42.856Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9127dd4e-0994-442f-8d73-b6b2dfb1f9ac",
                    "object_modified": "2026-10-13T17:45:36.505Z"
                },
                {
                    "object_ref": "x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963",
                    "object_modified": "2026-10-13T17:47:37.720Z"
                },
                {
                    "object_ref": "x-mitre-analytic--928c559b-3258-4760-a785-ba1270d7ea92",
                    "object_modified": "2026-10-13T17:46:00.102Z"
                },
                {
                    "object_ref": "x-mitre-analytic--930aae7c-e8f0-4594-8e3f-f0e71d7e1640",
                    "object_modified": "2026-10-13T17:47:25.745Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9508cebc-ee97-47e6-b603-5fdf88f9f54f",
                    "object_modified": "2026-10-13T17:44:09.300Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9510e414-3071-4e9c-af51-d07765393e32",
                    "object_modified": "2026-10-13T17:44:30.772Z"
                },
                {
                    "object_ref": "x-mitre-analytic--952ff035-fa50-4462-85e1-ee0287b68922",
                    "object_modified": "2026-10-13T17:47:12.770Z"
                },
                {
                    "object_ref": "x-mitre-analytic--96e7b86f-b960-489c-882b-9dcdb1c44aa9",
                    "object_modified": "2026-10-13T17:46:24.377Z"
                },
                {
                    "object_ref": "x-mitre-analytic--981b659b-992a-4d71-9404-0e1b2b598e50",
                    "object_modified": "2026-10-13T17:45:33.391Z"
                },
                {
                    "object_ref": "x-mitre-analytic--984bc0c8-77ee-4971-ba17-6a89fc401315",
                    "object_modified": "2026-10-13T17:46:21.543Z"
                },
                {
                    "object_ref": "x-mitre-analytic--98e017f6-93cd-46d0-8923-13a7697965a7",
                    "object_modified": "2026-09-25T19:05:32.264Z"
                },
                {
                    "object_ref": "x-mitre-analytic--99652f40-1f48-4a01-9e09-0585e02ce534",
                    "object_modified": "2026-10-13T17:48:01.582Z"
                },
                {
                    "object_ref": "x-mitre-analytic--99cde5ec-8f9f-4585-9195-5ed4509dc9cd",
                    "object_modified": "2026-10-13T17:48:08.042Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9a06af00-5f21-43c8-a4a3-24eaa28655c2",
                    "object_modified": "2026-10-13T17:45:56.223Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9ad83be0-5c88-4fb6-b59d-19db21176923",
                    "object_modified": "2026-10-13T17:47:38.213Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9b1bb08d-5aba-47f4-86d7-a5788c99e1ac",
                    "object_modified": "2026-10-13T17:46:07.425Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9e2addaf-2773-4bd1-8192-231451038024",
                    "object_modified": "2026-10-13T17:44:17.351Z"
                },
                {
                    "object_ref": "x-mitre-analytic--9fac6c8a-9320-47d1-aa1d-3bdd4f5856d3",
                    "object_modified": "2026-10-13T17:45:09.213Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a0774b4b-493d-4025-bf19-b94280371478",
                    "object_modified": "2026-10-13T17:45:32.099Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a0c69c57-549d-4cdd-82eb-0654d8df364e",
                    "object_modified": "2026-10-13T17:46:45.467Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a24f00d8-2d62-465a-a63c-5604058d195e",
                    "object_modified": "2026-10-13T17:45:39.691Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a2ab9718-e601-4c5d-94ad-6382df57987c",
                    "object_modified": "2026-10-13T17:44:55.885Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a318c729-65ad-424b-a67b-c6b38fb0a708",
                    "object_modified": "2026-10-13T17:47:30.129Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a4594062-42a7-448f-99fb-5e4b2c005410",
                    "object_modified": "2026-10-13T17:44:53.414Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a5255607-9d66-473a-ac88-8b4d0f2527f3",
                    "object_modified": "2026-10-05T19:26:54.586Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a5361f96-a1da-426b-9211-33f29d7d217a",
                    "object_modified": "2026-10-05T19:27:52.135Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a607836b-d6d0-4501-8f05-b43a5dac09c8",
                    "object_modified": "2026-10-13T17:44:10.401Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a7766ca3-ff83-48fe-b6aa-5a781c64d95b",
                    "object_modified": "2026-10-13T17:43:57.611Z"
                },
                {
                    "object_ref": "x-mitre-analytic--a97db312-a06f-4020-aef2-b28bb8d78c56",
                    "object_modified": "2026-10-13T17:46:10.320Z"
                },
                {
                    "object_ref": "x-mitre-analytic--aa83b39c-238f-4592-abaa-35e011218f98",
                    "object_modified": "2026-10-13T17:47:04.917Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ac890be9-5686-42bf-9a1c-ac7fd8bb283a",
                    "object_modified": "2026-10-13T17:46:18.406Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ad07439d-e13e-438a-9f4b-330d61f2607b",
                    "object_modified": "2026-10-13T17:44:08.147Z"
                },
                {
                    "object_ref": "x-mitre-analytic--aebd2848-98db-46f1-8e22-627e2ec3c280",
                    "object_modified": "2026-10-13T17:45:24.271Z"
                },
                {
                    "object_ref": "x-mitre-analytic--aef5883b-f520-4309-aacc-d233b31ec860",
                    "object_modified": "2026-10-13T17:44:16.185Z"
                },
                {
                    "object_ref": "x-mitre-analytic--af14d56d-c96c-4ab4-8377-a3ecfba26962",
                    "object_modified": "2026-10-13T17:44:41.445Z"
                },
                {
                    "object_ref": "x-mitre-analytic--afc9e394-147e-49db-81df-953d2d3ea93e",
                    "object_modified": "2026-10-13T17:47:18.240Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b011484e-65d1-408a-b361-67d945e9ca87",
                    "object_modified": "2026-10-13T17:44:26.091Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b03ff220-3bf8-41bd-a443-0ae287fa8e74",
                    "object_modified": "2026-10-13T17:45:15.479Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b048b681-7bce-468e-896b-da76f8b81d49",
                    "object_modified": "2026-10-13T17:46:44.589Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b15aa5f3-acb3-4de6-831b-3f2a259baf63",
                    "object_modified": "2026-10-13T17:47:20.300Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b1b08627-62b0-4ede-b07d-478be9721f5a",
                    "object_modified": "2026-10-13T17:47:13.564Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b1e81f19-f241-45ef-bfa5-2aa27d99ee0c",
                    "object_modified": "2026-10-13T17:45:41.465Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b26ae113-36e8-4ff4-94bb-bf058788979c",
                    "object_modified": "2026-10-13T17:44:11.584Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b3107fc4-e41d-4e1c-a895-6e6cdc9182ca",
                    "object_modified": "2026-10-13T17:45:16.880Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b337bf06-d69b-41e0-8e60-8f24cb718998",
                    "object_modified": "2026-10-13T17:46:33.957Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b41c2b27-08ce-4f3c-a810-484f100422a3",
                    "object_modified": "2026-10-13T17:45:37.638Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b4b66413-59b9-45bb-93d4-a0a99da9e9a4",
                    "object_modified": "2026-10-13T17:44:46.087Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b4eeeacf-6d03-4350-ae75-b87e28b697bc",
                    "object_modified": "2026-10-13T17:44:18.511Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b6fb91d0-28f6-447d-ba25-e7b26116ebfe",
                    "object_modified": "2026-10-13T17:46:37.455Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b74100d1-0085-468a-834a-2bf10924a3b7",
                    "object_modified": "2026-10-13T17:44:05.622Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b89b2084-97e0-47cc-a9fd-bea4d0423b06",
                    "object_modified": "2026-10-13T17:46:56.610Z"
                },
                {
                    "object_ref": "x-mitre-analytic--b968d9b9-b7f6-423b-b490-6a43ed97389f",
                    "object_modified": "2026-10-13T17:46:08.313Z"
                },
                {
                    "object_ref": "x-mitre-analytic--bd1cb276-2ab0-4a91-8099-5c8a957e4968",
                    "object_modified": "2026-10-13T17:47:49.520Z"
                },
                {
                    "object_ref": "x-mitre-analytic--bed265af-6f51-42c1-b4d2-691535a32d67",
                    "object_modified": "2026-10-13T17:46:42.631Z"
                },
                {
                    "object_ref": "x-mitre-analytic--beefb21a-0c89-4472-8a35-b1ac557018b5",
                    "object_modified": "2026-10-13T17:46:48.853Z"
                },
                {
                    "object_ref": "x-mitre-analytic--bef23fc2-f276-4dc4-9e09-c3c546c431a1",
                    "object_modified": "2026-10-13T17:45:05.421Z"
                },
                {
                    "object_ref": "x-mitre-analytic--bffafc31-542c-45f0-9af1-73e2a789f782",
                    "object_modified": "2026-10-05T19:31:18.686Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c0e95b25-fa40-4794-a262-498aff3b9fd1",
                    "object_modified": "2026-10-13T17:46:12.729Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c14544a4-5ca1-4523-97eb-4a9840d74c6d",
                    "object_modified": "2026-10-13T17:48:04.063Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c17121b6-e945-4799-8a00-77d183501a1e",
                    "object_modified": "2026-10-13T17:46:26.646Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c",
                    "object_modified": "2026-10-13T17:47:24.974Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c2027adc-ff27-4bdc-a9bd-2e96b4aacc15",
                    "object_modified": "2026-10-13T17:47:44.553Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c40ddd75-f2fc-4899-bda1-bff164c96622",
                    "object_modified": "2026-10-13T17:46:54.639Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c41ec8c0-34b0-4573-8643-7366cfbbe4ac",
                    "object_modified": "2026-10-13T17:45:47.613Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c4d5acb4-61c8-4142-bf26-5865d235f02f",
                    "object_modified": "2026-10-13T17:45:55.192Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c5204537-15c5-42ff-baee-f7d029157ca9",
                    "object_modified": "2026-10-13T17:44:22.547Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c5274e54-6a55-4aae-b438-aed5c1ef8acd",
                    "object_modified": "2026-10-13T17:47:19.423Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c556c91d-64a0-401c-9c41-18971eeca0f2",
                    "object_modified": "2026-10-13T17:44:21.233Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c5bd7cb8-0223-4cc6-a390-80178e24e48d",
                    "object_modified": "2026-10-13T17:43:59.535Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c6552643-bbf2-4686-b050-af6f652fca79",
                    "object_modified": "2026-10-13T17:44:49.649Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4",
                    "object_modified": "2026-10-13T17:47:54.751Z"
                },
                {
                    "object_ref": "x-mitre-analytic--c7880711-79fa-4ea5-9c77-b7d59a9740be",
                    "object_modified": "2026-10-05T19:25:14.907Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ca6b9523-4eba-48b2-8584-bed6fb3e6020",
                    "object_modified": "2026-10-13T17:45:34.934Z"
                },
                {
                    "object_ref": "x-mitre-analytic--caa6869b-e752-4fb8-a228-09abaa2d321c",
                    "object_modified": "2026-10-13T17:46:35.037Z"
                },
                {
                    "object_ref": "x-mitre-analytic--cbf791b4-5186-4205-ac5a-a56042aaebec",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--cc87a984-9ec1-40c8-bcc3-14e9c51ef9fd",
                    "object_modified": "2026-10-13T17:45:01.419Z"
                },
                {
                    "object_ref": "x-mitre-analytic--cd4c92f9-3107-45c7-9d95-19a44d7dc92c",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--cff25f71-859e-48bf-88d6-852d05e22b33",
                    "object_modified": "2026-10-13T17:45:29.258Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d1985f23-da68-4b46-a5ab-9645ab91a25b",
                    "object_modified": "2026-10-13T17:44:24.905Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d271c7fc-d76a-4fb0-a645-5db2c1223a32",
                    "object_modified": "2026-10-13T17:45:22.783Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d27cebed-41c5-46b8-8c98-a57d6c40805e",
                    "object_modified": "2026-10-13T17:46:02.723Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d2a6ecfe-089b-47cc-8f10-260ad2de9c2e",
                    "object_modified": "2026-10-13T17:46:03.526Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d3023733-5874-4746-a947-65925514e382",
                    "object_modified": "2026-10-13T17:46:33.230Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d3adcced-e0c1-4b3c-8a54-f0edd3805df0",
                    "object_modified": "2026-10-13T17:45:54.329Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d585c9c1-aa82-4b3c-a42d-eb499d996219",
                    "object_modified": "2026-10-13T17:46:31.042Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d5cdbfae-d4c3-4379-9330-de223f74fb09",
                    "object_modified": "2026-10-13T17:45:40.579Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4",
                    "object_modified": "2026-10-13T17:47:31.041Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d71e98fa-64d1-4ddb-acb1-bba1e4af6a73",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d8aba717-a6a9-4ded-815c-603dd4a44508",
                    "object_modified": "2026-10-13T17:46:55.746Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d9136693-c5b4-4f26-b1d5-2a2ad637ca0e",
                    "object_modified": "2026-10-05T19:46:15.444Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d937e4b8-20f2-44c1-9940-48c74318c715",
                    "object_modified": "2026-10-13T17:47:51.681Z"
                },
                {
                    "object_ref": "x-mitre-analytic--d9d759b9-6bd5-4c26-8872-cd0ccc173959",
                    "object_modified": "2026-09-26T01:47:44.692Z"
                },
                {
                    "object_ref": "x-mitre-analytic--da7a9116-f290-4160-a24a-930d8961ddf4",
                    "object_modified": "2026-10-13T17:46:25.464Z"
                },
                {
                    "object_ref": "x-mitre-analytic--dab4f5e6-0560-4a00-96eb-41301b836ea4",
                    "object_modified": "2026-10-07T13:21:11.422Z"
                },
                {
                    "object_ref": "x-mitre-analytic--dc014060-5116-4a2f-bac5-35ac1db8fabb",
                    "object_modified": "2026-10-13T17:47:29.050Z"
                },
                {
                    "object_ref": "x-mitre-analytic--dc472b4e-7b39-4bbb-810e-acbf9998a767",
                    "object_modified": "2026-10-13T17:46:28.525Z"
                },
                {
                    "object_ref": "x-mitre-analytic--dd25b818-ceb0-4518-9384-dcf895d4956b",
                    "object_modified": "2026-10-13T17:47:21.575Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ddfcd948-3526-4241-a12f-d7bf63468e40",
                    "object_modified": "2026-10-13T17:47:23.108Z"
                },
                {
                    "object_ref": "x-mitre-analytic--df7f8849-56a7-4e83-9fd7-a4f25227d960",
                    "object_modified": "2026-10-13T17:48:03.255Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e25ef816-bbfd-4656-8ecb-c7eebcba31d4",
                    "object_modified": "2026-10-13T17:45:28.497Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e25f2fd3-1172-447f-8c03-715689666691",
                    "object_modified": "2026-10-13T17:44:32.346Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e2a6f7a5-8316-4367-8e90-9d6560818250",
                    "object_modified": "2026-10-13T17:45:46.790Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e379be82-39d7-4ae4-8557-f846ba19cd4b",
                    "object_modified": "2026-10-13T17:47:07.989Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e3b493fc-9771-4e68-b7ec-e91556b22c46",
                    "object_modified": "2026-10-13T17:47:50.353Z"
                },
                {
                    "object_ref": "x-mitre-analytic--e8f51c53-fc55-441b-a45f-ba7709ccbce2",
                    "object_modified": "2026-10-13T17:44:39.237Z"
                },
                {
                    "object_ref": "x-mitre-analytic--eb0833b1-5675-43df-84cb-3c185653326a",
                    "object_modified": "2026-10-05T19:24:28.074Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ec4eaf43-4490-4833-a18a-e475ab244970",
                    "object_modified": "2026-10-13T17:47:16.942Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ec695157-8c3c-439b-9925-459c9d4172f0",
                    "object_modified": "2026-10-13T17:44:01.941Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ece52da2-ac60-4b0e-863f-ebbc95118a8c",
                    "object_modified": "2026-10-13T17:44:13.553Z"
                },
                {
                    "object_ref": "x-mitre-analytic--edd8297d-ec63-4b54-8d28-106f228dd535",
                    "object_modified": "2026-10-13T17:46:19.686Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ee51b3ed-fb50-46dc-b21f-d28a98467941",
                    "object_modified": "2026-10-13T17:45:57.072Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119",
                    "object_modified": "2026-10-13T17:45:25.620Z"
                },
                {
                    "object_ref": "x-mitre-analytic--efad38ee-8529-4860-9d22-d5a36626cb2d",
                    "object_modified": "2026-10-13T17:44:35.996Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f123f13f-b6f4-4e86-96cd-14df0e855e0f",
                    "object_modified": "2026-10-13T17:47:50.905Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f12aa823-91cc-40e1-93b7-eaa5f5fa9c4d",
                    "object_modified": "2026-10-13T17:47:27.472Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f17cd473-1711-4a92-b8c7-a9890d432032",
                    "object_modified": "2026-10-13T17:45:02.717Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f45c158a-7086-4172-9fe4-1684e0ca34ee",
                    "object_modified": "2026-10-13T17:45:50.059Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f4abf9a4-ce83-41cf-85e2-a823d46ebf10",
                    "object_modified": "2026-10-13T17:48:07.198Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f571ba94-73ab-4590-ba2c-739a93cde075",
                    "object_modified": "2026-10-13T17:44:57.810Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f6324642-d17d-49d4-90b2-bab9d229d6fa",
                    "object_modified": "2026-10-13T17:45:52.486Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f666f516-f8d0-41f6-9a4c-0ac6c1f6086b",
                    "object_modified": "2026-10-13T17:45:27.721Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f91f4654-219f-47a4-aa5a-7c1597f23908",
                    "object_modified": "2026-10-13T17:46:50.572Z"
                },
                {
                    "object_ref": "x-mitre-analytic--f95ebff8-48ae-409a-adfb-8230d870768b",
                    "object_modified": "2026-10-13T17:46:39.740Z"
                },
                {
                    "object_ref": "x-mitre-analytic--fbd4686e-f637-459b-ad48-c6fd7840acfa",
                    "object_modified": "2026-10-13T17:46:59.428Z"
                },
                {
                    "object_ref": "x-mitre-analytic--fc6641ac-5748-4498-89e9-d4ada2b6f88a",
                    "object_modified": "2026-10-13T17:44:03.392Z"
                },
                {
                    "object_ref": "x-mitre-analytic--fcfe9c48-3a5a-49c8-96c3-be79414a8419",
                    "object_modified": "2026-10-13T17:46:23.610Z"
                },
                {
                    "object_ref": "x-mitre-analytic--fde26204-97d9-4635-82c4-c7e3ed3c9a2c",
                    "object_modified": "2026-10-13T17:46:57.442Z"
                },
                {
                    "object_ref": "x-mitre-analytic--fe1b5de5-3919-480b-80b6-8914b6b1d098",
                    "object_modified": "2026-10-13T17:46:04.726Z"
                },
                {
                    "object_ref": "x-mitre-analytic--ff0f3e46-3817-4b77-a188-74720d721c03",
                    "object_modified": "2026-10-13T17:45:45.940Z"
                },
                {
                    "object_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
                    "object_modified": "2026-10-13T16:52:01.660Z"
                },
                {
                    "object_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
                    "object_modified": "2026-10-13T16:51:34.368Z"
                },
                {
                    "object_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
                    "object_modified": "2026-10-13T16:51:10.478Z"
                },
                {
                    "object_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
                    "object_modified": "2026-10-13T16:50:45.686Z"
                },
                {
                    "object_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
                    "object_modified": "2026-05-12T15:12:00.768Z"
                },
                {
                    "object_ref": "x-mitre-data-component--1177a4c5-31c8-400c-8544-9071166afa0e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "object_modified": "2026-10-13T17:43:42.443Z"
                },
                {
                    "object_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "object_modified": "2026-10-13T17:43:44.861Z"
                },
                {
                    "object_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "object_modified": "2026-10-13T17:43:40.408Z"
                },
                {
                    "object_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "object_modified": "2026-10-13T17:43:41.384Z"
                },
                {
                    "object_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "object_modified": "2026-10-13T17:43:51.337Z"
                },
                {
                    "object_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "object_modified": "2026-10-13T17:43:45.184Z"
                },
                {
                    "object_ref": "x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f",
                    "object_modified": "2026-10-13T17:43:56.655Z"
                },
                {
                    "object_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "object_modified": "2026-10-13T17:43:51.984Z"
                },
                {
                    "object_ref": "x-mitre-data-component--4dcd8ba3-2075-4f8b-941e-39884ffaac08",
                    "object_modified": "2025-11-12T22:03:39.105Z"
                },
                {
                    "object_ref": "x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705",
                    "object_modified": "2026-10-13T17:43:53.579Z"
                },
                {
                    "object_ref": "x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f",
                    "object_modified": "2026-10-13T17:43:45.560Z"
                },
                {
                    "object_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "object_modified": "2026-10-13T17:43:44.279Z"
                },
                {
                    "object_ref": "x-mitre-data-component--66531bc6-a509-4868-8314-4d599e91d222",
                    "object_modified": "2026-05-12T15:12:00.774Z"
                },
                {
                    "object_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "object_modified": "2026-10-13T17:43:48.219Z"
                },
                {
                    "object_ref": "x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c",
                    "object_modified": "2026-10-13T17:43:56.009Z"
                },
                {
                    "object_ref": "x-mitre-data-component--7b375092-3a61-448d-900a-77c9a4bde4dc",
                    "object_modified": "2025-11-12T22:03:39.105Z"
                },
                {
                    "object_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "object_modified": "2026-10-13T17:43:40.092Z"
                },
                {
                    "object_ref": "x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d",
                    "object_modified": "2026-10-13T17:43:43.366Z"
                },
                {
                    "object_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "object_modified": "2026-10-13T17:43:50.698Z"
                },
                {
                    "object_ref": "x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e",
                    "object_modified": "2026-10-13T17:43:47.873Z"
                },
                {
                    "object_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "object_modified": "2026-10-13T17:43:41.733Z"
                },
                {
                    "object_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "object_modified": "2026-10-13T17:43:46.287Z"
                },
                {
                    "object_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "object_modified": "2026-10-13T17:43:39.111Z"
                },
                {
                    "object_ref": "x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd",
                    "object_modified": "2026-10-13T17:43:47.221Z"
                },
                {
                    "object_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "object_modified": "2026-10-13T17:43:50.375Z"
                },
                {
                    "object_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "object_modified": "2026-10-13T17:43:46.928Z"
                },
                {
                    "object_ref": "x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706",
                    "object_modified": "2026-10-13T17:43:42.721Z"
                },
                {
                    "object_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "object_modified": "2026-10-13T17:43:40.707Z"
                },
                {
                    "object_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "object_modified": "2026-10-13T17:43:48.544Z"
                },
                {
                    "object_ref": "x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170",
                    "object_modified": "2026-10-13T17:43:52.610Z"
                },
                {
                    "object_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "object_modified": "2026-10-13T17:43:44.580Z"
                },
                {
                    "object_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "object_modified": "2026-10-13T17:43:44.003Z"
                },
                {
                    "object_ref": "x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3",
                    "object_modified": "2026-10-13T17:43:53.278Z"
                },
                {
                    "object_ref": "x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa",
                    "object_modified": "2026-10-13T17:43:49.731Z"
                },
                {
                    "object_ref": "x-mitre-data-component--faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b",
                    "object_modified": "2025-10-21T15:14:38.292Z"
                },
                {
                    "object_ref": "x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--12c1e727-7fa4-49b6-af81-366ed2ce231e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--40269753-26bd-437b-986e-159c66dec5e4",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--b1717cb4-d536-4e2b-b5e5-07e67e26183c",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--ba27545a-9c32-47ea-ba6a-cce50f1b326e",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--ca1cb239-ff6d-4f64-b9d7-41c8556a8b4f",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-data-source--f424e4b4-a8a4-4c58-a4ae-4f53bfd08563",
                    "object_modified": "2025-10-21T15:10:28.402Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--02744e21-5d1c-4290-820f-d355fc044f50",
                    "object_modified": "2026-09-25T20:00:54.346Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--045550b2-8bb3-43ee-92fc-214f955fabdc",
                    "object_modified": "2026-09-26T01:47:44.862Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--04bcf663-e6cd-42bf-8864-f4d1ad345263",
                    "object_modified": "2026-10-13T17:45:50.204Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--05f7d4e4-ae99-4339-b71a-59f1e317dc6d",
                    "object_modified": "2026-10-13T17:47:31.175Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--06443942-ba28-4d13-b4b4-93317d6eafa5",
                    "object_modified": "2026-10-13T17:48:06.182Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--08c090e3-c56f-4a8b-80f6-307a1daf46ea",
                    "object_modified": "2026-10-13T17:47:37.024Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--09754c36-7be2-4536-aad2-a6c3568ba0e5",
                    "object_modified": "2026-10-13T17:44:16.359Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--09f46edf-33f9-4c23-af2f-74864c27f616",
                    "object_modified": "2026-10-13T17:47:19.620Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--0f2e4927-401d-430e-96ed-90feb8df1b03",
                    "object_modified": "2026-10-13T17:47:25.144Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--105c127f-2777-452e-bf61-b0786ee13861",
                    "object_modified": "2026-10-13T17:45:54.503Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--13412b71-b94e-4aef-912a-44853f8bff05",
                    "object_modified": "2026-05-12T16:34:50.669Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--194cb4dd-81ca-4e64-94e2-911fab1219f9",
                    "object_modified": "2026-10-13T17:47:20.456Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--1bae319f-03d8-49c9-8bb8-e4f27bb69a11",
                    "object_modified": "2026-05-12T16:34:50.671Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--2145faf1-28da-4ebc-9730-f2e2a8764ced",
                    "object_modified": "2026-05-12T16:34:50.672Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--260bc795-4a3d-4ca6-8fd1-5e687112d20c",
                    "object_modified": "2026-10-05T22:42:10.773Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--2a1619a7-dd27-48e4-b56f-806cb3d2e405",
                    "object_modified": "2026-10-13T17:47:30.286Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--2e99cd65-aad4-4796-9013-79837d498eb6",
                    "object_modified": "2026-07-31T20:48:54.007Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--31773402-e407-4ed3-b86c-7a8587dc5ec9",
                    "object_modified": "2026-10-13T17:44:22.714Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--336b9423-5543-4354-bd00-13c614ccdc96",
                    "object_modified": "2026-10-13T17:47:28.708Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--33dd1c37-1702-4de2-9712-fcc640e4b681",
                    "object_modified": "2026-10-13T17:47:40.302Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--37b4971d-2eb8-4f87-899c-19acaf0394bb",
                    "object_modified": "2026-05-12T16:34:50.674Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--3a772c6d-fda2-404a-86aa-85a0bdbb43e9",
                    "object_modified": "2026-10-13T17:47:01.722Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--3e884c49-75ca-449e-83cb-3517ee88e0f1",
                    "object_modified": "2026-10-13T17:47:44.722Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--3ea60ac7-87a3-4033-9089-258941d8388a",
                    "object_modified": "2026-10-13T17:46:13.703Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--43a670e7-e016-4c29-8ec2-85c18e30f030",
                    "object_modified": "2026-09-26T02:41:26.112Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--441ded70-7e25-47f1-b55c-0fafb7d4f44c",
                    "object_modified": "2026-10-13T17:46:48.197Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--442bf059-f7cf-460b-8200-f35e1e0a0c78",
                    "object_modified": "2026-10-13T17:47:39.480Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--442e5dcf-7f41-4ba5-ba89-aefb0d1c63cf",
                    "object_modified": "2026-10-13T17:46:16.865Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--47c6f72c-1f2f-4ea8-94d0-08202b7d5bdb",
                    "object_modified": "2026-05-12T16:34:50.676Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--4a2e4d0b-dd28-4b0d-8b83-8c9e66826c62",
                    "object_modified": "2026-09-25T19:05:32.433Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--4ea060f9-f6fc-4122-9544-70afd567ea10",
                    "object_modified": "2026-10-13T17:47:55.820Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--519082ce-24ab-4f6b-9e86-b9443758c9d4",
                    "object_modified": "2026-10-13T17:46:58.830Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--527668a3-cc0c-48c2-856a-a45615817366",
                    "object_modified": "2026-10-13T17:47:12.091Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--5604323b-6e7a-4801-91ae-4bf591f2e3ac",
                    "object_modified": "2026-10-13T17:46:18.578Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--56bf71a3-a28b-4a8f-84ed-3a71449d47c0",
                    "object_modified": "2026-10-13T17:48:02.875Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--57970b21-17a5-4536-a089-5277ebc575f9",
                    "object_modified": "2026-10-13T13:30:13.534Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--58b4bda4-d69a-4a20-ab67-308c4451a5e8",
                    "object_modified": "2026-10-13T17:45:55.528Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--5ba60cf7-738d-4ed4-827c-8c763ad9f0f0",
                    "object_modified": "2026-10-13T17:47:03.413Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--60a55b7b-29a5-437e-83a7-edbe6f3c4415",
                    "object_modified": "2026-10-13T17:46:12.884Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--62587e44-0623-4b14-bd45-126430eaed4a",
                    "object_modified": "2026-10-13T17:46:45.686Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--636329e6-32b9-4a71-acf8-ae6d01a6b4ef",
                    "object_modified": "2026-10-13T17:47:07.632Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--67c2be08-d31a-4385-a637-9d1a907c7a26",
                    "object_modified": "2026-10-13T17:48:07.349Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--6bdde391-76eb-4bd7-9e19-e805ab98b7ac",
                    "object_modified": "2026-10-13T17:46:42.791Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--6c7f2661-c4c3-40d6-ac41-2997bc069de9",
                    "object_modified": "2026-09-26T03:28:48.440Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--6d2ba563-0aa9-4f64-a14d-da62b694b495",
                    "object_modified": "2026-10-13T17:47:58.355Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--6f318bab-df4a-4a51-b849-e9c2ab2f9c4c",
                    "object_modified": "2026-10-13T17:47:34.378Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--6f921aa8-deb3-4286-8101-26a7cbe80c0e",
                    "object_modified": "2026-05-12T16:34:50.681Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--709e05b2-6400-43a2-9bbf-b64f6017b023",
                    "object_modified": "2026-05-12T16:34:50.681Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--732d2487-3241-4866-8bb5-044bb4acdd3b",
                    "object_modified": "2026-10-13T17:47:56.723Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--73773bb8-c63b-4d48-9b48-33440f12a514",
                    "object_modified": "2026-07-31T20:48:55.817Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--74b96bd4-dab9-494e-a540-b7c998581fd5",
                    "object_modified": "2026-10-13T17:46:41.956Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--7f32731d-7800-483c-b077-c4a187a27ae5",
                    "object_modified": "2026-10-13T17:47:37.856Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--7f41ed29-fdc6-4c28-ba10-9de1aa129f7e",
                    "object_modified": "2026-05-12T16:34:50.682Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--825106d1-6f44-47a1-b8dd-c3e3b6cecab7",
                    "object_modified": "2026-10-13T17:47:49.663Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--87493fa2-bb78-4e28-b882-d79eecd10740",
                    "object_modified": "2026-10-13T17:47:11.255Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--887ae691-a519-4b68-af26-bcea1483cef7",
                    "object_modified": "2026-10-13T17:47:45.587Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--89e95503-b02c-43da-90b3-15584b27e6d6",
                    "object_modified": "2026-10-13T17:44:57.972Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--8ae936b6-b635-4104-bd11-81c18d90cf97",
                    "object_modified": "2026-10-13T17:47:13.720Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--930b268b-abf0-485f-9854-60c1cfdd2d33",
                    "object_modified": "2026-10-13T17:47:42.798Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--97914ffd-b189-415e-9309-e63e3be01b1e",
                    "object_modified": "2026-10-13T17:47:54.905Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--9ad17e7a-5920-42ac-9bf4-545b99162640",
                    "object_modified": "2026-10-13T17:47:52.970Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--9f3df5ac-caa0-4189-9b9b-dcf2f6bbdc54",
                    "object_modified": "2026-10-13T17:48:05.325Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--a24f6d21-a614-46bd-9817-f55a576a05ea",
                    "object_modified": "2026-10-05T19:35:10.217Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--a366d027-d797-4957-949a-870aed0766dd",
                    "object_modified": "2026-10-13T17:47:04.241Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--a995ba7c-c2c2-4d74-a3da-74e5a192099b",
                    "object_modified": "2026-05-12T16:34:50.687Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ab3f0926-58e2-485e-987c-66b541d9de97",
                    "object_modified": "2026-10-13T17:46:50.733Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ad675d25-2829-48e5-8475-28f1ed5d813a",
                    "object_modified": "2026-05-12T16:34:50.688Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ae24274b-0e20-451e-a883-6eeb0e8e7d00",
                    "object_modified": "2026-05-12T16:34:50.688Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--b04e83cc-8ace-4880-8953-7ce55eb8c427",
                    "object_modified": "2026-10-13T17:47:14.879Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--b25c4621-5d38-43ee-871e-0e5c02f2f48c",
                    "object_modified": "2026-10-13T17:46:46.543Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--b6a6d95c-e3b5-438d-a095-3fb0859c8f45",
                    "object_modified": "2026-10-13T17:46:53.518Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--b817139c-2941-4523-bfb5-10c36d230871",
                    "object_modified": "2026-10-13T17:47:50.533Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--bbb288c7-9e40-46bd-b0a1-db4cfef4e1ee",
                    "object_modified": "2026-10-13T17:47:41.969Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c0abb110-c80e-4d6a-9f27-f2783f8bbfec",
                    "object_modified": "2026-05-12T16:34:50.691Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c0e6c96d-8605-407a-9bce-628e7853b07f",
                    "object_modified": "2026-10-13T17:46:51.861Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c1645705-a26f-45b2-aa68-ff5c93dfc0f4",
                    "object_modified": "2026-07-31T20:48:56.515Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c4777f1a-1481-4e8a-a3f4-0da57418c808",
                    "object_modified": "2026-05-12T16:34:50.692Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c4ddc0d7-0296-4d92-9ae1-1a4b7b5d1640",
                    "object_modified": "2026-10-13T17:48:01.766Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c7737640-99e8-4efb-90ee-39332b623b33",
                    "object_modified": "2026-05-12T16:34:50.692Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c779ee07-ee85-42fe-a2c1-14ce25766cdf",
                    "object_modified": "2026-10-13T17:47:36.169Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c7aea5e8-cd8b-4f79-be41-3a446cdde7b7",
                    "object_modified": "2026-10-13T17:47:16.202Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--c94af5cb-61c3-4180-81e7-30c1669f4252",
                    "object_modified": "2026-05-12T16:34:50.692Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--cb273244-c117-4e32-afc7-f72f4e44e179",
                    "object_modified": "2026-10-13T17:46:44.772Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--d8cb1dd3-8bf2-48e7-99db-473481b823a8",
                    "object_modified": "2026-10-13T17:46:22.529Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--d9469edc-7e55-41bc-8b17-a8db9fc6302e",
                    "object_modified": "2026-05-12T16:34:50.694Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--de675cf4-144e-485c-a761-c72ebcb9e2bc",
                    "object_modified": "2026-05-12T16:34:50.695Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--e69d1e15-76e1-434c-bd45-0354a10dde8a",
                    "object_modified": "2026-05-12T16:34:50.696Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--e6bc5359-4bd4-4688-9136-ac7a6b561f56",
                    "object_modified": "2026-05-12T16:34:50.696Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--e8b537e6-04eb-4168-a206-88cc041edf50",
                    "object_modified": "2026-10-13T17:47:02.579Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--e90f1c0c-f2c5-4fe1-942f-411574df043f",
                    "object_modified": "2026-07-31T20:48:57.455Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--e9f6c9ad-7368-43e3-9ba1-c9261323a1d1",
                    "object_modified": "2026-10-13T17:47:32.751Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--eabde43f-1872-499d-9642-85a6959c4d28",
                    "object_modified": "2026-10-13T17:46:36.010Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ec442b22-3dc8-4b2b-8294-b76b0f01d748",
                    "object_modified": "2026-10-13T17:45:35.079Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--edf989d8-7e25-4ed2-b289-a55dee68a75e",
                    "object_modified": "2026-10-13T17:47:05.089Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f1a7e304-d05f-4e48-89b7-8b034f507c32",
                    "object_modified": "2026-10-13T17:48:08.206Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f487a605-0acb-4b12-b157-33b75ebd9a40",
                    "object_modified": "2026-10-13T17:47:59.186Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f4f3b9a6-2de0-45a5-8936-2ad9288191b9",
                    "object_modified": "2026-10-13T17:46:07.587Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f8400e7d-3443-4205-aaf3-1592b777416f",
                    "object_modified": "2026-09-25T18:45:14.263Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f9b7143b-ce86-4cfb-a03a-f39c01904fb1",
                    "object_modified": "2026-05-12T16:34:50.698Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--f9ea25e7-6e63-4ef1-a8ad-47a4a261e175",
                    "object_modified": "2026-05-12T16:34:50.698Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--fb0931d5-8eb9-4db2-a2a4-447c32b29bd4",
                    "object_modified": "2026-05-12T16:34:50.698Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--fddbd892-faa2-40e1-b40d-2c6e33c00f14",
                    "object_modified": "2026-05-12T16:34:50.698Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--fe11c904-752f-40e2-b269-c53bbb29541a",
                    "object_modified": "2026-05-12T16:34:50.698Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--feb80c7a-96cd-4300-b344-4d75b176c9cb",
                    "object_modified": "2026-10-13T17:46:26.784Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ff6456fc-576d-4da5-b561-b58f70961b15",
                    "object_modified": "2026-10-13T17:47:17.910Z"
                },
                {
                    "object_ref": "x-mitre-detection-strategy--ffeac6e1-798f-41b1-8baf-2650d2ebe031",
                    "object_modified": "2026-10-13T17:46:32.018Z"
                },
                {
                    "object_ref": "x-mitre-matrix--575f48f4-8897-4468-897b-48bb364af6c7",
                    "object_modified": "2026-07-31T20:48:58.509Z"
                },
                {
                    "object_ref": "x-mitre-tactic--298fe907-7931-4fd2-8131-2814dd493134",
                    "object_modified": "2025-04-16T21:26:21.065Z"
                },
                {
                    "object_ref": "x-mitre-tactic--33752ae7-f875-4f43-bdb6-d8d02d341046",
                    "object_modified": "2025-04-16T21:26:21.215Z"
                },
                {
                    "object_ref": "x-mitre-tactic--51c25a9e-8615-40c0-8afd-1da578847924",
                    "object_modified": "2025-04-16T21:26:21.394Z"
                },
                {
                    "object_ref": "x-mitre-tactic--696af733-728e-49d7-8261-75fdc590f453",
                    "object_modified": "2025-04-25T14:39:28.358Z"
                },
                {
                    "object_ref": "x-mitre-tactic--69da72d2-f550-41c5-ab9e-e8255707f28a",
                    "object_modified": "2025-04-25T14:39:28.727Z"
                },
                {
                    "object_ref": "x-mitre-tactic--77542f83-70d0-40c2-8a9d-ad2eb8b00279",
                    "object_modified": "2025-04-16T21:26:21.936Z"
                },
                {
                    "object_ref": "x-mitre-tactic--78f1d2ae-a579-44c4-8fc5-3e1775c73fac",
                    "object_modified": "2025-04-25T14:39:29.269Z"
                },
                {
                    "object_ref": "x-mitre-tactic--93bf9a8e-b14c-4587-b6d5-9efc7c12eb45",
                    "object_modified": "2025-04-16T21:26:22.274Z"
                },
                {
                    "object_ref": "x-mitre-tactic--97c8ff73-bd14-4b6c-ac32-3d91d2c41e3f",
                    "object_modified": "2025-04-25T14:39:29.812Z"
                },
                {
                    "object_ref": "x-mitre-tactic--b2a67b1e-913c-46f6-b219-048a90560bb9",
                    "object_modified": "2025-04-16T21:26:22.653Z"
                },
                {
                    "object_ref": "x-mitre-tactic--ddf70682-f3ce-479c-a9a4-7eadf9bfead7",
                    "object_modified": "2025-04-25T14:39:30.353Z"
                },
                {
                    "object_ref": "x-mitre-tactic--ff048b6c-b872-4218-b68c-3735ebd1f024",
                    "object_modified": "2025-04-16T21:26:23.006Z"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "spec_version": "2.1"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "created": "2024-11-20T23:15:36.728Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0041",
                    "external_id": "C0041"
                },
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                },
                {
                    "source_name": "Nozomi BUSTLEBERM 2024",
                    "description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
                    "url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.258Z",
            "name": "FrostyGoop Incident",
            "description": "[FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](https://attack.mitre.org/software/S1165) was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
            "aliases": [
                "FrostyGoop Incident"
            ],
            "first_seen": "2024-01-01T07:00:00.000Z",
            "last_seen": "2024-01-01T07:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
            "x_mitre_last_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "created": "2024-03-25T17:47:37.619Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0030",
                    "external_id": "C0030"
                },
                {
                    "source_name": "Triton-EENews-2017",
                    "description": "Blake Sobczak. (2019, March 7). The inside story of the world’s most dangerous malware. Retrieved March 25, 2024.",
                    "url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
                },
                {
                    "source_name": "FireEye TRITON 2017",
                    "description": "Johnson, B, et. al. (2017, December 14). Attackers Deploy New ICS Attack Framework \"TRITON\" and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "FireEye TRITON 2018",
                    "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.868Z",
            "name": "Triton Safety Instrumented System Attack",
            "description": "[Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030) was a campaign employed by [TEMP.Veles](https://attack.mitre.org/groups/G0088) which leveraged the [Triton](https://attack.mitre.org/software/S1009) malware framework against a petrochemical organization.(Citation: Triton-EENews-2017) The malware and techniques used within this campaign targeted specific Triconex [Safety Controller](https://attack.mitre.org/assets/A0010)s within the environment.(Citation: FireEye TRITON 2018) The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.(Citation: FireEye TRITON 2017)\n",
            "aliases": [
                "Triton Safety Instrumented System Attack"
            ],
            "first_seen": "2017-06-01T04:00:00.000Z",
            "last_seen": "2017-08-01T04:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Triton-EENews-2017)",
            "x_mitre_last_seen_citation": "(Citation: Triton-EENews-2017)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "created": "2023-09-27T13:11:52.340Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0028",
                    "external_id": "C0028"
                },
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.047Z",
            "name": "2015 Ukraine Electric Power Attack",
            "description": "[2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [BlackEnergy](https://attack.mitre.org/software/S0089) (specifically BlackEnergy3) and [KillDisk](https://attack.mitre.org/software/S0607) to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.",
            "aliases": [
                "2015 Ukraine Electric Power Attack"
            ],
            "first_seen": "2015-12-01T05:00:00.000Z",
            "last_seen": "2016-01-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Booz Allen Hamilton)",
            "x_mitre_last_seen_citation": "(Citation: Booz Allen Hamilton)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--65281d3e-b03c-46b8-8cd8-716363ac3cb2",
            "created": "2022-09-20T20:53:14.373Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0009",
                    "external_id": "C0009"
                },
                {
                    "source_name": "CISA AA21-042A Water Treatment Intrusion Feb 2021",
                    "description": "CISA. (2021, February 11). Compromise of U.S. Water Treatment Facility . Retrieved October 18, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa21-042a"
                },
                {
                    "source_name": "Pinellas County Sheriffs Office February 2021",
                    "description": "Pinellas County Sheriffs Office 2021, February 8 Treatment Plant Intrusion Press Conference Retrieved. 2021/10/08 ",
                    "url": "https://www.youtube.com/watch?v=MkXDSOgLQ6M"
                },
                {
                    "source_name": "Dragos Oldsmar Feb 2021",
                    "description": "Serino, G., et al . (2021, February 8). Recommendations Following the Oldsmar Water Treatment Facility Cyber Attack. Retrieved October 21, 2022.",
                    "url": "https://www.dragos.com/blog/industry-news/recommendations-following-the-oldsmar-water-treatment-facility-cyber-attack/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:15.905Z",
            "name": "Oldsmar Treatment Plant Intrusion",
            "description": "[Oldsmar Treatment Plant Intrusion](https://attack.mitre.org/campaigns/C0009) was a cyber incident involving a water treatment facility in Florida. During this incident, unidentified threat actors leveraged features of the system to access and modify setpoints for a specific chemical required in the treatment process. The incident was detected immediately and prevented before it could cause any harm to the public.(Citation: Pinellas County Sheriffs Office February 2021)(Citation: CISA AA21-042A Water Treatment Intrusion Feb 2021)(Citation: Dragos Oldsmar Feb 2021)",
            "aliases": [
                "Oldsmar Treatment Plant Intrusion"
            ],
            "first_seen": "2021-02-01T05:00:00.000Z",
            "last_seen": "2021-02-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Pinellas County Sheriffs Office February 2021)",
            "x_mitre_last_seen_citation": "(Citation: Pinellas County Sheriffs Office February 2021)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": true,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_domains": [
                "ics-attack"
            ]
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "created": "2023-03-10T20:01:08.133Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0020",
                    "external_id": "C0020"
                },
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:15.915Z",
            "name": "Maroochy Water Breach",
            "description": "[Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020) was an incident in 2000 where an adversary leveraged the local government’s wastewater control system and stolen engineering equipment to disrupt and eventually release 800,000 liters of raw sewage into the local community.(Citation: Marshall Abrams July 2008)",
            "aliases": [
                "Maroochy Water Breach"
            ],
            "first_seen": "2000-02-01T05:00:00.000Z",
            "last_seen": "2000-04-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Marshall Abrams July 2008)",
            "x_mitre_last_seen_citation": "(Citation: Marshall Abrams July 2008)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "created": "2024-03-25T19:58:53.090Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0031",
                    "external_id": "C0031"
                },
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                },
                {
                    "source_name": "Frank Bajak and Marc Levy December 2023",
                    "description": "Frank Bajak and Marc Levy. (2023, December 2). Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say. Retrieved March 25, 2024.",
                    "url": "https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b"
                },
                {
                    "source_name": "Lisa Zahner December 2023",
                    "description": "Lisa Zahner. (2023, December 15). Hackers in Iran attack computer at Vero Utilities. Retrieved March 25, 2024.",
                    "url": "https://veronews.com/2023/12/15/hackers-in-iran-attack-computer-at-vero-utilities/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.564Z",
            "name": "Unitronics Defacement Campaign",
            "description": "The [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031) was a collection of intrusions across multiple sectors by the [CyberAv3ngers](https://attack.mitre.org/groups/G1027), where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). The sectors that these PLCs can be commonly found in are water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the PLCs' HMIs.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: Frank Bajak and Marc Levy December 2023)",
            "aliases": [
                "Unitronics Defacement Campaign"
            ],
            "first_seen": "2023-11-01T04:00:00.000Z",
            "last_seen": "2023-11-01T04:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: CISA AA23-335A IRGC-Affiliated December 2023)",
            "x_mitre_last_seen_citation": "(Citation: Lisa Zahner December 2023)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "created": "2026-04-22T19:33:22.532Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0063",
                    "external_id": "C0063"
                },
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                },
                {
                    "source_name": "ESET DynoWiper Update JAN 2026",
                    "description": "ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.",
                    "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
                },
                {
                    "source_name": "ESET DynoWiper JAN 2026",
                    "description": "ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.",
                    "url": "https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"
                },
                {
                    "source_name": "Dragos ELECTRUM JAN 2026",
                    "description": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf. (2026, January). ELECTRUM: CYBER ATTACK ON POLAND’S ELECTRIC SYSTEM 2025. Retrieved April 22, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.151Z",
            "name": "2025 Poland Wiper Attacks",
            "description": "[2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, [DynoWiper](https://attack.mitre.org/software/S9038), a Windows-based wiper and [LazyWiper](https://attack.mitre.org/software/S9039), a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group [Dragonfly](https://attack.mitre.org/groups/G0035), also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)",
            "aliases": [
                "2025 Poland Wiper Attacks",
                "2025 Poland Wiper Campaign"
            ],
            "first_seen": "2025-03-01T05:00:00.000Z",
            "last_seen": "2025-12-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
            "x_mitre_last_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ]
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "created": "2023-03-31T17:22:23.567Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0025",
                    "external_id": "C0025"
                },
                {
                    "source_name": "ESET Industroyer",
                    "description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:24.494Z",
            "name": "2016 Ukraine Electric Power Attack",
            "description": "[2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [Industroyer](https://attack.mitre.org/software/S0604) malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
            "aliases": [
                "2016 Ukraine Electric Power Attack"
            ],
            "first_seen": "2016-12-01T05:00:00.000Z",
            "last_seen": "2016-12-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
            "x_mitre_last_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ]
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "created": "2024-03-27T19:43:25.703Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0034",
                    "external_id": "C0034"
                },
                {
                    "source_name": "Dragos-Sandworm-Ukraine-2022",
                    "description": "Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.",
                    "url": "https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/"
                },
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:11:04.731Z",
            "name": "2022 Ukraine Electric Power Attack",
            "description": "The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022) ",
            "aliases": [
                "2022 Ukraine Electric Power Attack"
            ],
            "first_seen": "2022-06-01T04:00:00.000Z",
            "last_seen": "2022-10-01T04:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "x_mitre_last_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ]
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "created": "2019-06-11T17:06:56.230Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0948",
                    "external_id": "M0948"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:25.920Z",
            "name": "Application Isolation and Sandboxing",
            "description": "Restrict the execution of code to a virtual environment on or in-transit to an endpoint system.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 5.4",
                "IEC 62443-4-2:2019 - CR 5.4",
                "NIST SP 800-53 Rev. 5 - SI-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "created": "2019-06-11T16:33:55.337Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0937",
                    "external_id": "M0937"
                },
                {
                    "source_name": "Centre for the Protection of National Infrastructure February 2005",
                    "description": "Centre for the Protection of National Infrastructure 2005, February FIREWALL DEPLOYMENT FOR SCADA AND PROCESS CONTROL NETWORKS Retrieved. 2020/09/17 ",
                    "url": "https://www.energy.gov/sites/prod/files/Good%20Practices%20Guide%20for%20Firewall%20Deployment.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Filter Network Traffic",
            "description": "Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.   Perform inline allow/denylisting of network messages based on the application layer (OSI Layer 7) protocol, especially for automation protocols. Application allowlists are beneficial when there are well-defined communication sequences, types, rates, or patterns needed during expected system operations. Application denylists may be needed if all acceptable communication sequences cannot be defined, but instead a set of known malicious uses can be denied (e.g., excessive communication  attempts, shutdown messages, invalid commands).  Devices performing these functions are often referred to as deep-packet inspection (DPI) firewalls, context-aware firewalls, or firewalls blocking specific automation/SCADA protocol aware firewalls. (Citation: Centre for the Protection of National Infrastructure February 2005)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 5.1",
                "IEC 62443-4-2:2019 - CR 5.1",
                "NIST SP 800-53 Rev. 5 - AC-3; SC-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "created": "2019-06-06T20:52:59.206Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0921",
                    "external_id": "M0921"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:52:26.035Z",
            "name": "Restrict Web-Based Content",
            "description": "Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 2.4",
                "IEC 62443-4-2:2019 - HDR 2.4",
                "NIST SP 800-53 Rev. 5 - SC-18"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517",
            "created": "2023-03-22T15:49:55.439Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0818",
                    "external_id": "M0818"
                },
                {
                    "source_name": "PLCTop20 Mar 2023",
                    "description": "PLC Security, Top 20 Community. (2021, June 15). Secure PLC Coding Practices: Top 20 version 1.0. Retrieved March 22, 2023.",
                    "url": "https://plc-security.com/content/Top_20_Secure_PLC_Coding_Practices_V1.0.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:26.390Z",
            "name": "Validate Program Inputs",
            "description": "Devices and programs designed to interact with control system parameters should validate the format and content of all user inputs and actions to ensure the values are within intended operational ranges. These values should be evaluated and further enforced through the program logic running on the field controller. If a problematic or invalid input is identified, the programs should either utilize a predetermined safe value or enter a known safe state, while also logging or alerting on the event.(Citation: PLCTop20 Mar 2023)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.5",
                "IEC 62443-3-3:2013 - SR 3.6",
                "IEC 62443-4-2:2019 - CR 3.5",
                "IEC 62443-4-2:2019 - CR 3.6",
                "NIST SP 800-53 Rev. 5 - SI-10"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "created": "2019-06-10T20:41:03.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0930",
                    "external_id": "M0930"
                },
                {
                    "source_name": "IEC August 2013",
                    "description": "IEC 2013, August Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/7033"
                },
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Network Segmentation",
            "description": "Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network.  Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network. (Citation: IEC February 2019) (Citation: IEC August 2013)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 5.1",
                "IEC 62443-4-2:2019 - CR 5.1",
                "NIST SP 800-53 Rev. 5 - AC-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--2ab9fc6d-3cf6-4d7b-85f1-3ad6949233b3",
            "created": "2019-06-11T17:00:01.740Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0944",
                    "external_id": "M0944"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:26.729Z",
            "name": "Restrict Library Loading",
            "description": "Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.7",
                "IEC 62443-4-2:2019 - CR 7.7",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--2f0160b7-e982-49d7-9612-f19b810f1722",
            "created": "2019-06-06T16:39:58.291Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0915",
                    "external_id": "M0915"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:12.577Z",
            "name": "Active Directory Configuration",
            "description": "Configure Active Directory to prevent use of certain techniques; use security identifier (SID) Filtering, etc.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "created": "2019-06-10T20:46:02.263Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0931",
                    "external_id": "M0931"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Network Intrusion Prevention",
            "description": "Use intrusion detection signatures to block traffic at network boundaries.  In industrial control environments, network intrusion prevention should be configured so it will not disrupt protocols and communications responsible for real-time functions related to control or safety.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 6.2",
                "IEC 62443-4-2:2019 - CR 6.2",
                "NIST SP 800-53 Rev. 5 - SI-4"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--3222a807-521b-4a1a-aa13-f1cda45734b3",
            "created": "2019-06-06T20:58:59.577Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0924",
                    "external_id": "M0924"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:27.274Z",
            "name": "Restrict Registry Permissions",
            "description": "Restrict the ability to modify certain hives or keys in the Windows Registry.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 2.1",
                "IEC 62443-4-2:2019 - CR 2.1",
                "NIST SP 800-53 Rev. 5 - AC-6"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--337c4e2a-21a7-4d9a-bfee-9efd6cebf0e5",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0803",
                    "external_id": "M0803"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:13.297Z",
            "name": "Data Loss Prevention",
            "description": "Data Loss Prevention (DLP) technologies can be used to help identify adversarial attempts to exfiltrate operational information, such as engineering plans, trade secrets, recipes, intellectual property, or process telemetry. DLP functionality may be built into other security products such as firewalls or standalone suites running on the network and host-based agents. DLP may be configured to prevent the transfer of information through corporate resources such as email, web, and physical media such as USB for host-based solutions.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 4.1",
                "IEC 62443-4-2:2019 - CR 4.1"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0801",
                    "external_id": "M0801"
                },
                {
                    "source_name": "Centre for the Protection of National Infrastructure November 2010",
                    "description": "Centre for the Protection of National Infrastructure 2010, November Configuring and Managing Remote Access for Industrial Control Systems Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/RP_Managing_Remote_Access_S508NC.pdf"
                },
                {
                    "source_name": "McCarthy, J et al. July 2018",
                    "description": "McCarthy, J et al. 2018, July NIST SP 1800-2 Identity and Access Management for Electric Utilities Retrieved. 2020/09/17 ",
                    "url": "https://doi.org/10.6028/NIST.SP.1800-2"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Access Management",
            "description": "Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provide sufficient capabilities to support user identification and authentication. (Citation: McCarthy, J et al. July 2018) These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials. (Citation: Centre for the Protection of National Infrastructure November 2010)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 2.1",
                "IEC 62443-4-2:2019 - CR 2.1",
                "NIST SP 800-53 Rev. 5 - AC-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0816",
                    "external_id": "M0816"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Mitigation Limited or Not Effective",
            "description": "This type of attack technique cannot be easily mitigated with preventative controls since it is based on the abuse of system features.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "created": "2019-06-11T17:10:57.070Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0950",
                    "external_id": "M0950"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:50:11.297Z",
            "name": "Exploit Protection",
            "description": "Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.2",
                "IEC 62443-4-2:2019 - CR 3.2",
                "NIST SP 800-53 Rev. 5 - SI-16"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--49b306c1-a046-42c5-a4d2-30f264ada110",
            "created": "2019-06-11T16:30:16.672Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0935",
                    "external_id": "M0935"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:27.991Z",
            "name": "Limit Access to Resource Over Network",
            "description": "Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 5.1",
                "IEC 62443-4-2:2019 - CR 5.1",
                "NIST SP 800-53 Rev. 5 - AC-3; SC-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "created": "2019-06-11T16:35:25.488Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0938",
                    "external_id": "M0938"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:52:00.813Z",
            "name": "Execution Prevention",
            "description": "Block execution of code on a system through application control, and/or script blocking.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.2",
                "IEC 62443-4-2:2019 - CR 3.2",
                "NIST SP 800-53 Rev. 5 - SI-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0814",
                    "external_id": "M0814"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Static Network Configuration",
            "description": "Configure hosts and devices to use static network configurations when possible, protocols that require dynamic discovery/addressing (e.g., ARP, DHCP, DNS) can be used to manipulate network message forwarding and enable various AiTM attacks. This mitigation may not always be usable due to limited device features or challenges introduced with different network configurations.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.7",
                "IEC 62443-4-2:2019 - CR 7.7",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "created": "2019-06-06T21:10:35.792Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0927",
                    "external_id": "M0927"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Password Policies",
            "description": "Set and enforce secure password policies for accounts.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.5",
                "IEC 62443-4-2:2019 - CR 1.5",
                "NIST SP 800-53 Rev. 5 - IA-5"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "created": "2019-06-06T21:09:47.115Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0926",
                    "external_id": "M0926"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:28.652Z",
            "name": "Privileged Account Management",
            "description": "Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.3",
                "IEC 62443-4-2:2019 - CR 1.3",
                "NIST SP 800-53 Rev. 5 - AC-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0804",
                    "external_id": "M0804"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.730Z",
            "name": "Human User Authentication",
            "description": "Require user authentication before allowing access to data or accepting commands to a device. While strong multi-factor authentication is preferable, it is not always feasible within ICS environments. Performing strong user authentication also requires additional security controls and processes which are often the target of related adversarial techniques (e.g., Valid Accounts, Default Credentials). Therefore, associated ATT&CK mitigations should be considered in addition to this, including [Multi-factor Authentication](https://attack.mitre.org/mitigations/M0932), [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), [User Account Management](https://attack.mitre.org/mitigations/M0918), [Privileged Account Management](https://attack.mitre.org/mitigations/M0926), and [User Account Control](https://attack.mitre.org/mitigations/M1052).",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.1",
                "IEC 62443-4-2:2019 - CR 1.1",
                "NIST SP 800-53 Rev. 5 - IA-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--6a02e38a-9629-40c0-8c7d-e98e3470315c",
            "created": "2019-06-06T20:15:34.146Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0920",
                    "external_id": "M0920"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:15.463Z",
            "name": "SSL/TLS Inspection",
            "description": "Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "created": "2019-06-11T17:01:25.405Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0945",
                    "external_id": "M0945"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Code Signing",
            "description": "Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.4",
                "IEC 62443-4-2:2019 - CR 3.4",
                "NIST SP 800-53 Rev. 5 - SI-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0813",
                    "external_id": "M0813"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Software Process and Device Authentication",
            "description": "Require the authentication of devices and software processes where appropriate. Devices that connect remotely to other systems should require strong authentication to prevent spoofing of communications. Furthermore, software processes should also require authentication when accessing APIs.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.2",
                "IEC 62443-4-2:2019 - CR 1.2",
                "NIST SP 800-53 Rev. 5 - IA-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0808",
                    "external_id": "M0808"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Encrypt Network Traffic",
            "description": "Utilize strong cryptographic techniques and protocols to prevent eavesdropping on network communications.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 4.1",
                "IEC 62443-4-2:2019 - CR 4.1",
                "NIST SP 800-53 Rev. 5 - SC-8"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--86b455f2-fb63-4043-93a8-32a3a7703a02",
            "created": "2019-06-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0936",
                    "external_id": "M0936"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:29.323Z",
            "name": "Account Use Policies",
            "description": "Configure features related to account use like login attempt lockouts, specific login times, etc.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.11",
                "IEC 62443-4-2:2019 - CR 1.11",
                "NIST SP 800-53 Rev. 5 - IA-5"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--8a3aadd0-b5f4-433a-800e-4893e4196bb7",
            "created": "2017-10-25T14:48:53.732Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0913",
                    "external_id": "M0913"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:29.489Z",
            "name": "Application Developer Guidance",
            "description": "This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.",
            "labels": [
                "NIST SP 800-53 Rev. 4 - AT-3",
                "NIST SP 800-53 Rev. 4 - AT-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--8ac1d6e1-b07f-476a-9732-84984ebc2405",
            "created": "2019-06-11T17:02:36.984Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0946",
                    "external_id": "M0946"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Boot Integrity",
            "description": "Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.",
            "labels": [
                "IEC 62443-4-2:2019 - CR 3.14",
                "NIST SP 800-53 Rev. 5 - SI-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--8bc4a54e-810c-4600-8b6c-08fa8413a401",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0805",
                    "external_id": "M0805"
                },
                {
                    "source_name": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004",
                    "description": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY  IEC 61511 Retrieved. 2020/09/17 ",
                    "url": "https://www.icheme.org/media/9906/xviii-paper-23.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:16.894Z",
            "name": "Mechanical Protection Layers",
            "description": "Utilize a layered protection design based on physical or mechanical protection systems to prevent damage to property, equipment, human safety, or the environment. Examples include interlocks, rupture disk, release values, etc. (Citation: A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004) ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "created": "2019-06-11T17:12:55.207Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0951",
                    "external_id": "M0951"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:30.090Z",
            "name": "Update Software",
            "description": "Perform regular software updates to mitigate exploitation risk. Software updates may need to be scheduled around operational down times.",
            "labels": [
                "IEC 62443-4-2:2019 - CR 3.10",
                "NIST SP 800-53 Rev. 5 - SI-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--98aa0d61-fc9d-4b2d-8f18-b25d03549f53",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0815",
                    "external_id": "M0815"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:17.436Z",
            "name": "Watchdog Timers",
            "description": "Utilize watchdog timers to ensure devices can quickly detect whether a system is unresponsive.",
            "labels": [
                "IEC 62443-4-2:2019 - CR 7.2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--99c746d7-a08a-4169-94f9-b8c0dad716fa",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0809",
                    "external_id": "M0809"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:17.799Z",
            "name": "Operational Information Confidentiality",
            "description": "Deploy mechanisms to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).",
            "labels": [
                "IEC 62443-3-3:2013 - SR 4.1",
                "IEC 62443-4-2:2019 - CR 4.1"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--9a945a29-5233-4422-a9e3-3e957b0e8bce",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0928",
                    "external_id": "M0928"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:30.648Z",
            "name": "Operating System Configuration",
            "description": "Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.7",
                "IEC 62443-4-2:2019 - CR 7.7",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--9e3adcad-0b8f-4ecc-a2f3-06f607f53bf0",
            "created": "2019-06-11T16:28:41.809Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0934",
                    "external_id": "M0934"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:30.822Z",
            "name": "Limit Hardware Installation",
            "description": "Block users or groups from installing or using unapproved hardware on systems, including USB devices.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.2",
                "IEC 62443-4-2:2019 - EDR 3.2",
                "NIST SP 800-53 Rev. 5 - MP-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "created": "2019-06-11T16:43:44.834Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0941",
                    "external_id": "M0941"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Encrypt Sensitive Information",
            "description": "Protect sensitive data-at-rest with strong encryption.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 4.1",
                "IEC 62443-4-2:2019 - CR 4.1",
                "NIST SP 800-53 Rev. 5 - SC-28"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "created": "2019-06-10T20:53:36.319Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0807",
                    "external_id": "M0807"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Network Allowlists",
            "description": "Network allowlists can be implemented through either host-based files or system hosts files to specify what connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the  application layer (e.g., DNP3, Modbus, HTTP) are addressed in [Filter Network Traffic](https://attack.mitre.org/mitigations/M0937) mitigation.",
            "labels": [
                "NIST SP 800-53 Rev. 5 - AC-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--ac8f3492-7fbb-4a0a-b0b4-b75ec676136c",
            "created": "2021-04-12T17:00:21.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0817",
                    "external_id": "M0817"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:31.301Z",
            "name": "Supply Chain Management",
            "description": "Implement a supply chain management program, including policies and procedures to ensure all devices and components originate from a trusted supplier and are tested to verify their integrity.",
            "labels": [
                "NIST SP 800-53 Rev. 4 - SA-12",
                "NIST SP 800-53 Rev. 5 - SR-1"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "created": "2019-07-19T14:33:33.543Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0953",
                    "external_id": "M0953"
                },
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:31.496Z",
            "name": "Data Backup",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.   Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of  'gold-copy' back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.3",
                "IEC 62443-4-2:2019 - CR 7.3",
                "NIST SP 800-53 Rev. 5 - CP-9"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0810",
                    "external_id": "M0810"
                },
                {
                    "source_name": "Defense Advanced Research Projects Agency",
                    "description": "Defense Advanced Research Projects Agency National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17  Rapid Attack Detection, Isolation and Characterization Systems (RADICS) Retrieved. 2020/09/17 ",
                    "url": "https://www.darpa.mil/program/rapid-attack-detection-isolation-and-characterization-systems"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Out-of-Band Communications Channel",
            "description": "Have alternative methods to support communication requirements during communication failures and data integrity attacks. (Citation: National Institute of Standards and Technology April 2013) (Citation: Defense Advanced Research Projects Agency)",
            "labels": [
                "NIST SP 800-53 Rev. 5 - SC-37"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "created": "2019-06-11T17:06:14.029Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0947",
                    "external_id": "M0947"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Audit",
            "description": "Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.4",
                "IEC 62443-4-2:2019 - CR 3.4",
                "NIST SP 800-53 Rev. 4 - SI-7",
                "NIST SP 800-53 Rev. 5 - SI-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0802",
                    "external_id": "M0802"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Communication Authenticity",
            "description": "When communicating over an untrusted network, utilize secure network protocols that both authenticate the message sender and can verify its integrity. This can be done either through message authentication codes (MACs) or digital signatures, to detect spoofed network messages and unauthorized connections.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.1",
                "IEC 62443-4-2:2019 - CR 3.1",
                "NIST SP 800-53 Rev. 5 - SC-8; SC-23"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "created": "2019-06-11T16:45:19.740Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0942",
                    "external_id": "M0942"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:50:45.716Z",
            "name": "Disable or Remove Feature or Program",
            "description": "Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.7",
                "IEC 62443-4-2:2019 - CR 7.7",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--d48b79b2-076d-483e-949c-0d38aa347499",
            "created": "2019-06-06T19:55:50.927Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0919",
                    "external_id": "M0919"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:19.937Z",
            "name": "Threat Intelligence Program",
            "description": "A threat intelligence program helps an organization generate their own threat intelligence information and track trends to inform defensive priorities to mitigate risk.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--da44255d-85c5-492c-baf3-ee823d44f848",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0812",
                    "external_id": "M0812"
                },
                {
                    "source_name": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004",
                    "description": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY  IEC 61511 Retrieved. 2020/09/17 ",
                    "url": "https://www.icheme.org/media/9906/xviii-paper-23.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:20.300Z",
            "name": "Safety Instrumented Systems",
            "description": "Utilize Safety Instrumented Systems (SIS) to provide an additional layer of protection to hazard scenarios that may cause property damage. A SIS will typically include sensors, logic solvers, and a final control element that can be used to automatically respond to an hazardous condition  (Citation: A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004) . Ensure that all SISs are segmented from operational networks to prevent them from being targeted by additional adversarial behavior.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
            "created": "2019-06-06T16:50:04.963Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0917",
                    "external_id": "M0917"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:32.717Z",
            "name": "User Training",
            "description": "Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.",
            "labels": [
                "NIST SP 800-53 Rev. 5 - AT-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--ddf3e568-f065-49e2-9106-42029a28ddbd",
            "created": "2019-06-10T20:53:36.319Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0932",
                    "external_id": "M0932"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:32.907Z",
            "name": "Multi-factor Authentication",
            "description": "Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.  Within industrial control environments assets such as low-level controllers, workstations, and HMIs have real-time operational control and safety requirements which may restrict the use of multi-factor.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.7",
                "IEC 62443-4-2:2019 - CR 1.7",
                "NIST SP 800-53 Rev. 5 - IA-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
            "created": "2019-06-06T16:47:30.700Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0916",
                    "external_id": "M0916"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:33.110Z",
            "name": "Vulnerability Scanning",
            "description": "Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them.",
            "labels": [
                "NIST SP 800-53 Rev. 5 - RA-5"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0800",
                    "external_id": "M0800"
                },
                {
                    "source_name": "Institute of Electrical and Electronics Engineers January 2014",
                    "description": "Institute of Electrical and Electronics Engineers 2014, January 1686-2013 - IEEE Standard for Intelligent Electronic Devices Cyber Security Capabilities Retrieved. 2020/09/17 ",
                    "url": "https://standards.ieee.org/standard/1686-2013.html"
                },
                {
                    "source_name": "International Electrotechnical Commission July 2020",
                    "description": "International Electrotechnical Commission 2020, July 17 IEC 62351 - Power systems management and associated information exchange - Data and communications security Retrieved. 2020/09/17 ",
                    "url": "https://webstore.iec.ch/publication/6912"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Authorization Enforcement",
            "description": "The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies.  Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector  (Citation: International Electrotechnical Commission July 2020), while IEEE 1686 defines standard permissions for users of IEDs. (Citation: Institute of Electrical and Electronics Engineers January 2014)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 2.1",
                "IEC 62443-4-2:2019 - CR 2.1",
                "NIST SP 800-53 Rev. 5 - AC-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "created": "2019-06-06T16:50:58.767Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0918",
                    "external_id": "M0918"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:33.298Z",
            "name": "User Account Management",
            "description": "Manage the creation, modification, use, and permissions associated to user accounts.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.3",
                "IEC 62443-4-2:2019 - CR 1.3",
                "NIST SP 800-53 Rev. 5 - AC-2"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "created": "2019-06-06T21:16:18.709Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0811",
                    "external_id": "M0811"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:33.475Z",
            "name": "Redundancy of Service",
            "description": "Redundancy could be provided for both critical ICS devices and services, such as back-up devices or hot-standbys.",
            "labels": [
                "NIST SP 800-53 Rev. 5 - CP-9"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "created": "2019-06-06T20:54:49.964Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0922",
                    "external_id": "M0922"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.731Z",
            "name": "Restrict File and Directory Permissions",
            "description": "Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 2.1",
                "IEC 62443-4-2:2019 - CR 2.1",
                "NIST SP 800-53 Rev. 5 - AC-6"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--facb8840-ebe7-49f1-b464-8ef6c8131e21",
            "created": "2019-07-19T14:40:23.529Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0954",
                    "external_id": "M0954"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:33.833Z",
            "name": "Software Configuration",
            "description": "Implement configuration changes to software (other than the operating system) to mitigate security risks associated with how the software operates.",
            "labels": [
                "IEC 62443-3-3:2013 - SR 7.7",
                "IEC 62443-4-2:2019 - CR 7.7",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
            "created": "2019-06-11T17:08:33.055Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0949",
                    "external_id": "M0949"
                },
                {
                    "source_name": "NCCIC August 2018",
                    "description": "NCCIC 2018, August 2 Recommended Practice: Updating Antivirus in an Industrial Control System Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/Recommended%20Practice%20Updating%20Antivirus%20in%20an%20Industrial%20Control%20System_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:34.009Z",
            "name": "Antivirus/Antimalware",
            "description": "Use signatures or heuristics to detect malicious software.  Within industrial control environments, antivirus/antimalware installations should be limited to assets that are not involved in critical or real-time operations. To minimize the impact to system availability, all products should first be validated within a representative test environment before deployment to production systems. (Citation: NCCIC August 2018)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.2",
                "IEC 62443-4-2:2019 - CR 3.2",
                "NIST SP 800-53 Rev. 4 - SI-3",
                "NIST SP 800-53 Rev. 5 - SI-3"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e",
            "created": "2020-09-11T16:32:21.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M0806",
                    "external_id": "M0806"
                },
                {
                    "source_name": "CISA March 2010",
                    "description": "CISA 2010, March Securing Wireless Networks Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/ncas/tips/ST05-003"
                },
                {
                    "source_name": "DHS  National Urban Security Technology Laboratory April 2019",
                    "description": "DHS  National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17 ",
                    "url": "https://www.dhs.gov/sites/default/files/saver-msr-rf-detection_cod-508_10july2019.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:34.172Z",
            "name": "Minimize Wireless Signal Propagation",
            "description": "Wireless signals frequently propagate outside of organizational boundaries, which provide opportunities for adversaries to monitor or gain unauthorized access to the wireless network. (Citation: CISA March 2010) To minimize this threat, organizations should implement measures to detect, understand, and reduce unnecessary RF propagation. (Citation: DHS  National Urban Security Technology Laboratory April 2019)",
            "labels": [
                "IEC 62443-3-3:2013 - SR 1.6",
                "IEC 62443-4-2:2019 - CR 1.6",
                "NIST SP 800-53 Rev. 5 - SC-40"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
            "created": "2019-01-29T21:27:24.793Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0082",
                    "external_id": "G0082"
                },
                {
                    "source_name": "BeagleBoyz",
                    "description": "(Citation: CISA AA20-239A BeagleBoyz August 2020)"
                },
                {
                    "source_name": "Stardust Chollima",
                    "description": "(Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)"
                },
                {
                    "source_name": "APT38",
                    "description": "(Citation: FireEye APT38 Oct 2018)"
                },
                {
                    "source_name": "Bluenoroff",
                    "description": "(Citation: Kaspersky Lazarus Under The Hood Blog 2017)"
                },
                {
                    "source_name": "Sapphire Sleet",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "COPERNICIUM",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "NICKEL GLADSTONE",
                    "description": "(Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)"
                },
                {
                    "source_name": "CrowdStrike GTR 2021 June 2021",
                    "description": "CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.",
                    "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
                },
                {
                    "source_name": "DOJ North Korea Indictment Feb 2021",
                    "description": "Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.",
                    "url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
                },
                {
                    "source_name": "CISA AA20-239A BeagleBoyz August 2020",
                    "description": "DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
                },
                {
                    "source_name": "FireEye APT38 Oct 2018",
                    "description": "FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
                },
                {
                    "source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
                    "description": "GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.",
                    "url": "https://securelist.com/lazarus-under-the-hood/77908/"
                },
                {
                    "source_name": "CrowdStrike Stardust Chollima Profile April 2018",
                    "description": "Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.",
                    "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Microsoft Axios Compromise APR 2026",
                    "description": "Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
                },
                {
                    "source_name": "Microsoft Sapphire Sleet APR 2026",
                    "description": "Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
                },
                {
                    "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
                    "description": "Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
                },
                {
                    "source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
                    "description": "SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.",
                    "url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T03:56:03.463Z",
            "name": "APT38",
            "description": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
            "aliases": [
                "APT38",
                "NICKEL GLADSTONE",
                "BeagleBoyz",
                "Bluenoroff",
                "Stardust Chollima",
                "Sapphire Sleet",
                "COPERNICIUM"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "4.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Hiroki Nagahama, NEC Corporation",
                "Manikantan Srinivasan, NEC Corporation India",
                "Pooja Natarajan, NEC Corporation India"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
            "created": "2017-05-31T21:31:57.307Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G1000",
                    "external_id": "G1000"
                },
                {
                    "source_name": "Dragos",
                    "description": "Dragos   Allanite Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/resource/allanite/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:27.733Z",
            "name": "ALLANITE",
            "description": "[ALLANITE](https://attack.mitre.org/groups/G1000) is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to [Dragonfly](https://attack.mitre.org/groups/G0035), although [ALLANITE](https://attack.mitre.org/groups/G1000)s technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence. (Citation: Dragos)",
            "aliases": [
                "ALLANITE",
                "Palmetto Fusion"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
            "created": "2017-05-31T21:32:05.217Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0035",
                    "external_id": "G0035"
                },
                {
                    "source_name": "DYMALLOY",
                    "description": "(Citation: Dragos DYMALLOY )(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "Berserk Bear",
                    "description": "(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "TEMP.Isotope",
                    "description": "(Citation: Mandiant Ukraine Cyber Threats January 2022)(Citation: Gigamon Berserk Bear October 2021)"
                },
                {
                    "source_name": "Ghost Blizzard",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "BROMINE",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "Crouching Yeti",
                    "description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "IRON LIBERTY",
                    "description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "TG-4192",
                    "description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "Dragonfly",
                    "description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "Energetic Bear",
                    "description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
                },
                {
                    "source_name": "CISA AA20-296A Berserk Bear December 2020",
                    "description": "CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"
                },
                {
                    "source_name": "DOJ Russia Targeting Critical Infrastructure March 2022",
                    "description": "Department of Justice. (2022, March 24). Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide. Retrieved April 5, 2022.",
                    "url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical"
                },
                {
                    "source_name": "Dragos DYMALLOY ",
                    "description": "Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.",
                    "url": "https://www.dragos.com/threat/dymalloy/"
                },
                {
                    "source_name": "Fortune Dragonfly 2.0 Sept 2017",
                    "description": "Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.",
                    "url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/"
                },
                {
                    "source_name": "Mandiant Ukraine Cyber Threats January 2022",
                    "description": "Hultquist, J. (2022, January 20). Anticipating Cyber Threats as the Ukraine Crisis Escalates. Retrieved January 24, 2022.",
                    "url": "https://www.mandiant.com/resources/ukraine-crisis-cyber-threats"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Secureworks MCMD July 2019",
                    "description": "Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.",
                    "url": "https://www.secureworks.com/research/mcmd-malware-analysis"
                },
                {
                    "source_name": "Secureworks IRON LIBERTY July 2019",
                    "description": "Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020.",
                    "url": "https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"
                },
                {
                    "source_name": "Secureworks Karagany July 2019",
                    "description": "Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.",
                    "url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
                },
                {
                    "source_name": "Gigamon Berserk Bear October 2021",
                    "description": "Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.",
                    "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
                },
                {
                    "source_name": "Symantec Dragonfly Sept 2017",
                    "description": "Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.",
                    "url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
                },
                {
                    "source_name": "Symantec Dragonfly",
                    "description": "Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.",
                    "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
                },
                {
                    "source_name": "Symantec Dragonfly 2.0 October 2017",
                    "description": "Symantec. (2017, October 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved April 19, 2022.",
                    "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks"
                },
                {
                    "source_name": "UK GOV FSB Factsheet April 2022",
                    "description": "UK Gov. (2022, April 5). Russia's FSB malign activity: factsheet. Retrieved April 5, 2022.",
                    "url": "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.048Z",
            "name": "Dragonfly",
            "description": "[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)",
            "aliases": [
                "Dragonfly",
                "TEMP.Isotope",
                "DYMALLOY",
                "Berserk Bear",
                "TG-4192",
                "Crouching Yeti",
                "IRON LIBERTY",
                "Energetic Bear",
                "Ghost Blizzard",
                "BROMINE"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "4.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
            "created": "2017-05-31T21:32:06.015Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0037",
                    "external_id": "G0037"
                },
                {
                    "source_name": "Skeleton Spider",
                    "description": "(Citation: Crowdstrike Global Threat Report Feb 2018)"
                },
                {
                    "source_name": "FIN6",
                    "description": "(Citation: FireEye FIN6 April 2016)"
                },
                {
                    "source_name": "TAAL",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "Camouflage Tempest",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "Magecart Group 6",
                    "description": "(Citation: Security Intelligence ITG08 April 2020)"
                },
                {
                    "source_name": "ITG08",
                    "description": "(Citation: Security Intelligence More Eggs Aug 2019)"
                },
                {
                    "source_name": "Crowdstrike Global Threat Report Feb 2018",
                    "description": "CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.",
                    "url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
                },
                {
                    "source_name": "FireEye FIN6 April 2016",
                    "description": "FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"
                },
                {
                    "source_name": "FireEye FIN6 Apr 2019",
                    "description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Security Intelligence ITG08 April 2020",
                    "description": "Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020.",
                    "url": "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/"
                },
                {
                    "source_name": "Security Intelligence More Eggs Aug 2019",
                    "description": "Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.",
                    "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:30.435Z",
            "name": "FIN6",
            "description": "[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)",
            "aliases": [
                "FIN6",
                "Magecart Group 6",
                "ITG08",
                "Skeleton Spider",
                "TAAL",
                "Camouflage Tempest"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "4.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)",
                "Drew Church, Splunk"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
            "created": "2017-05-31T21:32:09.460Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0046",
                    "external_id": "G0046"
                },
                {
                    "source_name": "Carbon Spider",
                    "description": "(Citation: CrowdStrike Carbon Spider August 2021)"
                },
                {
                    "source_name": "FIN7",
                    "description": "(Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018)"
                },
                {
                    "source_name": "ELBRUS",
                    "description": "(Citation: Microsoft Ransomware as a Service)"
                },
                {
                    "source_name": "Sangria Tempest",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "GOLD NIAGARA",
                    "description": "(Citation: Secureworks GOLD NIAGARA Threat Profile)"
                },
                {
                    "source_name": "Mandiant FIN7 Apr 2022",
                    "description": "Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.",
                    "url": "https://www.mandiant.com/resources/evolution-of-fin7"
                },
                {
                    "source_name": "FireEye CARBANAK June 2017",
                    "description": "Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
                },
                {
                    "source_name": "BiZone Lizar May 2021",
                    "description": "BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.",
                    "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
                },
                {
                    "source_name": "FireEye FIN7 April 2017",
                    "description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
                },
                {
                    "source_name": "FireEye FIN7 Aug 2018",
                    "description": "Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
                },
                {
                    "source_name": "Secureworks GOLD NIAGARA Threat Profile",
                    "description": "CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.",
                    "url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
                },
                {
                    "source_name": "FireEye FIN7 Shim Databases",
                    "description": "Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
                },
                {
                    "source_name": "Morphisec FIN7 June 2017",
                    "description": "Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017.",
                    "url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
                },
                {
                    "source_name": "ITG14",
                    "description": "ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020)"
                },
                {
                    "source_name": "CrowdStrike Carbon Spider August 2021",
                    "description": "Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.",
                    "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Microsoft Ransomware as a Service",
                    "description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
                },
                {
                    "source_name": "FireEye FIN7 March 2017",
                    "description": "Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.",
                    "url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
                },
                {
                    "source_name": "IBM Ransomware Trends September 2020",
                    "description": "Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.",
                    "url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:31.412Z",
            "name": "FIN7",
            "description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)(Citation: BiZone Lizar May 2021)",
            "aliases": [
                "FIN7",
                "GOLD NIAGARA",
                "ITG14",
                "Carbon Spider",
                "ELBRUS",
                "Sangria Tempest"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "4.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Edward Millington",
                "Eric Loui, CrowdStrike Intelligence",
                "Serhii Melnyk, Trustwave SpiderLabs"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "created": "2017-05-31T21:32:04.588Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0034",
                    "external_id": "G0034"
                },
                {
                    "source_name": "Voodoo Bear",
                    "description": "(Citation: CrowdStrike VOODOO BEAR)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "ELECTRUM",
                    "description": "(Citation: Dragos ELECTRUM)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "Sandworm Team",
                    "description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014) (Citation: InfoSecurity Sandworm Oct 2014)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "Quedagh",
                    "description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "FROZENBARENTS",
                    "description": "(Citation: Leonard TAG 2023)"
                },
                {
                    "source_name": "APT44",
                    "description": "(Citation: mandiant_apt44_unearthing_sandworm)"
                },
                {
                    "source_name": "IRIDIUM",
                    "description": "(Citation: Microsoft Prestige ransomware October 2022)"
                },
                {
                    "source_name": "Seashell Blizzard",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "BlackEnergy (Group)",
                    "description": "(Citation: NCSC Sandworm Feb 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "Telebots",
                    "description": "(Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "IRON VIKING",
                    "description": "(Citation: Secureworks IRON VIKING )(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
                },
                {
                    "source_name": "Leonard TAG 2023",
                    "description": "Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.",
                    "url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
                },
                {
                    "source_name": "US District Court Indictment GRU Oct 2018",
                    "description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
                    "url": "https://www.justice.gov/opa/page/file/1098481/download"
                },
                {
                    "source_name": "Dragos ELECTRUM",
                    "description": "Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.dragos.com/resource/electrum/"
                },
                {
                    "source_name": "F-Secure BlackEnergy 2014",
                    "description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
                    "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
                },
                {
                    "source_name": "iSIGHT Sandworm 2014",
                    "description": "Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.",
                    "url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
                },
                {
                    "source_name": "CrowdStrike VOODOO BEAR",
                    "description": "Meyers, A. (2018, January 19). Meet CrowdStrike’s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018.",
                    "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Microsoft Prestige ransomware October 2022",
                    "description": "MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
                },
                {
                    "source_name": "InfoSecurity Sandworm Oct 2014",
                    "description": "Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian ‘Sandworm’ Hackers. Retrieved October 6, 2017.",
                    "url": "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/"
                },
                {
                    "source_name": "NCSC Sandworm Feb 2020",
                    "description": "NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.",
                    "url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
                },
                {
                    "source_name": "USDOJ Sandworm Feb 2020",
                    "description": "Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024.",
                    "url": "https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html"
                },
                {
                    "source_name": "mandiant_apt44_unearthing_sandworm",
                    "description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                },
                {
                    "source_name": "Secureworks IRON VIKING ",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                },
                {
                    "source_name": "UK NCSC Olympic Attacks October 2020",
                    "description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
                    "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:32.342Z",
            "name": "Sandworm Team",
            "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)\n\nIn October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)",
            "aliases": [
                "Sandworm Team",
                "ELECTRUM",
                "Telebots",
                "IRON VIKING",
                "BlackEnergy (Group)",
                "Quedagh",
                "Voodoo Bear",
                "IRIDIUM",
                "Seashell Blizzard",
                "FROZENBARENTS",
                "APT44"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "4.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence",
                "Hakan KARABACAK"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0049",
                    "external_id": "G0049"
                },
                {
                    "source_name": "IRN2",
                    "description": "(Citation: Crowdstrike Helix Kitten Nov 2018)"
                },
                {
                    "source_name": "ITG13",
                    "description": "(Citation: IBM ZeroCleare Wiper December 2019)"
                },
                {
                    "source_name": "Hazel Sandstorm",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "EUROPIUM",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "OilRig",
                    "description": "(Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: Unit 42 QUADAGENT July 2018)"
                },
                {
                    "source_name": "TA452",
                    "description": "(Citation: Proofpoint Iranian Aligned Attacks JAN 2020)"
                },
                {
                    "source_name": "COBALT GYPSY",
                    "description": "(Citation: Secureworks COBALT GYPSY Threat Profile)"
                },
                {
                    "source_name": "Crambus",
                    "description": "(Citation: Symantec Crambus OCT 2023)"
                },
                {
                    "source_name": "Earth Simnavaz",
                    "description": "(Citation: Trend Micro Earth Simnavaz October 2024)"
                },
                {
                    "source_name": "Helix Kitten",
                    "description": "(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)"
                },
                {
                    "source_name": "Evasive Serpens",
                    "description": "(Citation: Unit42 OilRig Playbook 2023)"
                },
                {
                    "source_name": "Check Point APT34 April 2021",
                    "description": "Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.",
                    "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
                },
                {
                    "source_name": "ClearSky OilRig Jan 2017",
                    "description": "ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.",
                    "url": "http://www.clearskysec.com/oilrig/"
                },
                {
                    "source_name": "Trend Micro Earth Simnavaz October 2024",
                    "description": "Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.",
                    "url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
                },
                {
                    "source_name": "Palo Alto OilRig May 2016",
                    "description": "Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.",
                    "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
                },
                {
                    "source_name": "Palo Alto OilRig April 2017",
                    "description": "Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.",
                    "url": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/"
                },
                {
                    "source_name": "Palo Alto OilRig Oct 2016",
                    "description": "Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.",
                    "url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
                },
                {
                    "source_name": "IBM ZeroCleare Wiper December 2019",
                    "description": "Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.",
                    "url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
                },
                {
                    "source_name": "Unit 42 QUADAGENT July 2018",
                    "description": "Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.",
                    "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
                },
                {
                    "source_name": "Crowdstrike Helix Kitten Nov 2018",
                    "description": "Meyers, A. (2018, November 27). Meet CrowdStrike’s Adversary of the Month for November: HELIX KITTEN. Retrieved December 18, 2018.",
                    "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Proofpoint Iranian Aligned Attacks JAN 2020",
                    "description": "Proofpoint. (2020, January 10). Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself. Retrieved January 16, 2025.",
                    "url": "https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect"
                },
                {
                    "source_name": "FireEye APT34 Dec 2017",
                    "description": "Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
                },
                {
                    "source_name": "Secureworks COBALT GYPSY Threat Profile",
                    "description": "Secureworks. (n.d.). COBALT GYPSY Threat Profile. Retrieved April 14, 2021.",
                    "url": "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy"
                },
                {
                    "source_name": "Symantec Crambus OCT 2023",
                    "description": "Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.",
                    "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
                },
                {
                    "source_name": "APT34",
                    "description": "This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.(Citation: Unit 42 QUADAGENT July 2018)(Citation: FireEye APT34 Dec 2017)(Citation: Check Point APT34 April 2021)"
                },
                {
                    "source_name": "Unit 42 Playbook Dec 2017",
                    "description": "Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.",
                    "url": "https://pan-unit42.github.io/playbook_viewer/"
                },
                {
                    "source_name": "Unit42 OilRig Playbook 2023",
                    "description": "Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.",
                    "url": "https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:34.886Z",
            "name": "OilRig",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: Unit 42 QUADAGENT July 2018)",
            "aliases": [
                "OilRig",
                "COBALT GYPSY",
                "IRN2",
                "APT34",
                "Helix Kitten",
                "Evasive Serpens",
                "Hazel Sandstorm",
                "EUROPIUM",
                "ITG13",
                "Earth Simnavaz",
                "Crambus",
                "TA452"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "5.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Robert Falcone",
                "Bryan Lee",
                "Dragos Threat Intelligence",
                "Jaesang Oh, KC7 Foundation"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6",
            "created": "2018-01-16T16:13:52.465Z",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0057",
                    "external_id": "G0057"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:36.792Z",
            "name": "APT34",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--76d59913-1d24-4992-a8ac-05a3eb093f71",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0074",
                    "external_id": "G0074"
                },
                {
                    "source_name": "DYMALLOY",
                    "description": "(Citation: Dragos DYMALLOY )"
                },
                {
                    "source_name": "Berserk Bear",
                    "description": "(Citation: Fortune Dragonfly 2.0 Sept 2017)"
                },
                {
                    "source_name": "IRON LIBERTY",
                    "description": "(Citation: Secureworks MCMD July 2019)(Citation: Secureworks IRON LIBERTY)"
                },
                {
                    "source_name": "Dragonfly 2.0",
                    "description": "(Citation: US-CERT TA18-074A) (Citation: Symantec Dragonfly Sept 2017) (Citation: Fortune Dragonfly 2.0 Sept 2017)"
                },
                {
                    "source_name": "Dragos DYMALLOY ",
                    "description": "Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.",
                    "url": "https://www.dragos.com/threat/dymalloy/"
                },
                {
                    "source_name": "Fortune Dragonfly 2.0 Sept 2017",
                    "description": "Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.",
                    "url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/"
                },
                {
                    "source_name": "Secureworks MCMD July 2019",
                    "description": "Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.",
                    "url": "https://www.secureworks.com/research/mcmd-malware-analysis"
                },
                {
                    "source_name": "Secureworks IRON LIBERTY",
                    "description": "Secureworks. (n.d.). IRON LIBERTY. Retrieved October 15, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-liberty"
                },
                {
                    "source_name": "Symantec Dragonfly Sept 2017",
                    "description": "Symantec Security Response. (2017, September 6). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.",
                    "url": "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
                },
                {
                    "source_name": "US-CERT TA18-074A",
                    "description": "US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T17:59:27.618Z",
            "name": "Dragonfly 2.0",
            "description": "[Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. (Citation: US-CERT TA18-074A) (Citation: Symantec Dragonfly Sept 2017) There is debate over the extent of overlap between [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) and [Dragonfly](https://attack.mitre.org/groups/G0035), but there is sufficient evidence to lead to these being tracked as two separate groups. (Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Dragos DYMALLOY )",
            "aliases": [
                "Dragonfly 2.0",
                "IRON LIBERTY",
                "DYMALLOY",
                "Berserk Bear"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
            "created": "2019-04-16T15:14:38.533Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0088",
                    "external_id": "G0088"
                },
                {
                    "source_name": "TEMP.Veles",
                    "description": "(Citation: FireEye TRITON 2019)"
                },
                {
                    "source_name": "Dragos Xenotime 2018",
                    "description": "Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.",
                    "url": "https://dragos.com/resource/xenotime/"
                },
                {
                    "source_name": "FireEye TEMP.Veles 2018",
                    "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
                },
                {
                    "source_name": "FireEye TRITON 2019",
                    "description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"
                },
                {
                    "source_name": "FireEye TEMP.Veles JSON April 2019",
                    "description": "Miller, S., et al. (2019, April 10). TRITON Appendix C. Retrieved April 29, 2019.",
                    "url": "https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html"
                },
                {
                    "source_name": "Pylos Xenotime 2019",
                    "description": "Slowik, J.. (2019, April 12). A XENOTIME to Remember: Veles in the Wild. Retrieved April 16, 2019.",
                    "url": "https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/"
                },
                {
                    "source_name": "XENOTIME",
                    "description": "The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://attack.mitre.org/software/S0609).(Citation: Dragos Xenotime 2018)(Citation: Pylos Xenotime 2019)(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:41.930Z",
            "name": "TEMP.Veles",
            "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)",
            "aliases": [
                "TEMP.Veles",
                "XENOTIME"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.4",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "created": "2024-03-25T19:57:07.829Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G1027",
                    "external_id": "G1027"
                },
                {
                    "source_name": "Soldiers of Soloman",
                    "description": "CyberAv3ngers reportedly has connections to the IRGC-linked group Soldiers of Solomon.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)"
                },
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T13:46:33.122Z",
            "name": "CyberAv3ngers",
            "description": "The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)\n\nIn 2023, the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) engaged in a global targeting and hacking of the Unitronics [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)",
            "aliases": [
                "CyberAv3ngers",
                "Soldiers of Soloman"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133",
            "created": "2020-09-22T19:41:27.845Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0115",
                    "external_id": "G0115"
                },
                {
                    "source_name": "Pinchy Spider",
                    "description": "(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)"
                },
                {
                    "source_name": "Secureworks REvil September 2019",
                    "description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                },
                {
                    "source_name": "CrowdStrike Evolution of Pinchy Spider July 2021",
                    "description": "Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023.",
                    "url": "https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/"
                },
                {
                    "source_name": "Secureworks GandCrab and REvil September 2019",
                    "description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
                },
                {
                    "source_name": "Secureworks GOLD SOUTHFIELD",
                    "description": "Secureworks. (n.d.). GOLD SOUTHFIELD. Retrieved October 6, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/gold-southfield"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:45.767Z",
            "name": "GOLD SOUTHFIELD",
            "description": "[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)",
            "aliases": [
                "GOLD SOUTHFIELD",
                "Pinchy Spider"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Thijn Bukkems, Amazon"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
            "created": "2017-05-31T21:32:03.807Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0032",
                    "external_id": "G0032"
                },
                {
                    "source_name": "Labyrinth Chollima",
                    "description": "(Citation: CrowdStrike Labyrinth Chollima Feb 2022)"
                },
                {
                    "source_name": "Diamond Sleet",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "ZINC",
                    "description": "(Citation: Microsoft ZINC disruption Dec 2017)"
                },
                {
                    "source_name": "Lazarus Group",
                    "description": "(Citation: Novetta Blockbuster)"
                },
                {
                    "source_name": "NICKEL ACADEMY",
                    "description": "(Citation: Secureworks NICKEL ACADEMY Dec 2017)"
                },
                {
                    "source_name": "Guardians of Peace",
                    "description": "(Citation: US-CERT HIDDEN COBRA June 2017)"
                },
                {
                    "source_name": "CrowdStrike Labyrinth Chollima Feb 2022",
                    "description": "CrowdStrike. (2022, February 1). CrowdStrike Adversary Labyrinth Chollima. Retrieved February 1, 2022.",
                    "url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
                },
                {
                    "source_name": "Mandiant DPRK Groups 2023",
                    "description": "Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.",
                    "url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
                },
                {
                    "source_name": "Mandiant DPRK Laz Org Breakdown 2022",
                    "description": "Michael Barnhart, Michelle Cantos, Jeffery Johnson, Elias fox, Gary Freas, Dan Scott. (2022, March 23). Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations. Retrieved September 9, 2025.",
                    "url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Novetta Blockbuster",
                    "description": "Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.",
                    "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
                },
                {
                    "source_name": "Secureworks NICKEL ACADEMY Dec 2017",
                    "description": "Secureworks. (2017, December 15). Media Alert - Secureworks Discovers North Korean Cyber Threat Group, Lazarus, Spearphishing Financial Executives of Cryptocurrency Companies. Retrieved December 27, 2017.",
                    "url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
                },
                {
                    "source_name": "Microsoft ZINC disruption Dec 2017",
                    "description": "Smith, B. (2017, December 19). Microsoft and Facebook disrupt ZINC malware attack to protect customers and the internet from ongoing cyberthreats. Retrieved December 20, 2017.",
                    "url": "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"
                },
                {
                    "source_name": "HIDDEN COBRA",
                    "description": "The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: US-CERT HOPLIGHT Apr 2019)"
                },
                {
                    "source_name": "Treasury North Korean Cyber Groups September 2019",
                    "description": "US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.",
                    "url": "https://home.treasury.gov/news/press-releases/sm774"
                },
                {
                    "source_name": "US-CERT HIDDEN COBRA June 2017",
                    "description": "US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure. Retrieved July 13, 2017.",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
                },
                {
                    "source_name": "US-CERT HOPLIGHT Apr 2019",
                    "description": "US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.",
                    "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
                },
                {
                    "source_name": "JPCert Blog Laz Subgroups 2025",
                    "description": "佐々木勇人 Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup. Retrieved August 25, 2025.",
                    "url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:46.106Z",
            "name": "Lazarus Group",
            "description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster)\n\nNorth Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)\n\n",
            "aliases": [
                "Lazarus Group",
                "Labyrinth Chollima",
                "HIDDEN COBRA",
                "Guardians of Peace",
                "ZINC",
                "NICKEL ACADEMY",
                "Diamond Sleet"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "5.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Kyaw Pyiyt Htet, @KyawPyiytHtet",
                "Dragos Threat Intelligence",
                "MyungUk Han, ASEC",
                "Jun Hirata, NEC Corporation",
                "Manikantan Srinivasan, NEC Corporation India",
                "Pooja Natarajan, NEC Corporation India"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
            "created": "2020-05-12T18:15:29.396Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0102",
                    "external_id": "G0102"
                },
                {
                    "source_name": "Grim Spider",
                    "description": "(Citation: CrowdStrike Ryuk January 2019)(Citation: CrowdStrike Grim Spider May 2019)"
                },
                {
                    "source_name": "UNC1878",
                    "description": "(Citation: FireEye KEGTAP SINGLEMALT October 2020)"
                },
                {
                    "source_name": "TEMP.MixMaster",
                    "description": "(Citation: FireEye Ryuk and Trickbot January 2019)"
                },
                {
                    "source_name": "ITG23",
                    "description": "(Citation: IBM X-Force ITG23 Oct 2021)"
                },
                {
                    "source_name": "FIN12",
                    "description": "(Citation: Mandiant FIN12 Oct 2021)"
                },
                {
                    "source_name": "Periwinkle Tempest",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "DEV-0193",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "Pistachio Tempest",
                    "description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
                },
                {
                    "source_name": "DEV-0237",
                    "description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
                },
                {
                    "source_name": "GOLD BLACKBURN",
                    "description": "(Citation: Secureworks Gold Blackburn Mar 2022)"
                },
                {
                    "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
                    "description": "DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
                },
                {
                    "source_name": "FireEye Ryuk and Trickbot January 2019",
                    "description": "Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
                },
                {
                    "source_name": "CrowdStrike Ryuk January 2019",
                    "description": "Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.",
                    "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
                },
                {
                    "source_name": "CrowdStrike Grim Spider May 2019",
                    "description": "John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.",
                    "url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
                },
                {
                    "source_name": "FireEye KEGTAP SINGLEMALT October 2020",
                    "description": "Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.",
                    "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Microsoft_PistachioTempest_Jan2024",
                    "description": "Microsoft. (2024, January 25). Financially Motivated Threat Actor Pistachio Tempest. Retrieved December 15, 2025.",
                    "url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest"
                },
                {
                    "source_name": "CrowdStrike Wizard Spider October 2020",
                    "description": "Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.",
                    "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
                },
                {
                    "source_name": "Secureworks Gold Blackburn Mar 2022",
                    "description": "Secureworks Counter Threat Unit. (2022, March 1). Gold Blackburn Threat Profile. Retrieved June 15, 2023.",
                    "url": "https://www.secureworks.com/research/threat-profiles/gold-blackburn"
                },
                {
                    "source_name": "Mandiant FIN12 Oct 2021",
                    "description": "Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.",
                    "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
                },
                {
                    "source_name": "IBM X-Force ITG23 Oct 2021",
                    "description": "Villadsen, O., et al. (2021, October 13). Trickbot Rising - Gang Doubles Down on Infection Efforts to Amass Network Footholds. Retrieved June 15, 2023.",
                    "url": "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:49.730Z",
            "name": "Wizard Spider",
            "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)",
            "aliases": [
                "Wizard Spider",
                "UNC1878",
                "TEMP.MixMaster",
                "Grim Spider",
                "FIN12",
                "GOLD BLACKBURN",
                "ITG23",
                "Periwinkle Tempest",
                "DEV-0193",
                "Pistachio Tempest",
                "DEV-0237"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "4.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Edward Millington",
                "Oleksiy Gayda"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G1001",
                    "external_id": "G1001"
                },
                {
                    "source_name": "Spirlin",
                    "description": "(Citation: Accenture Lyceum Targets November 2021)"
                },
                {
                    "source_name": "Siamesekitten",
                    "description": "(Citation: ClearSky Siamesekitten August 2021)"
                },
                {
                    "source_name": "Lyceum",
                    "description": "(Citation: SecureWorks August 2019)"
                },
                {
                    "source_name": "Accenture Lyceum Targets November 2021",
                    "description": "Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.",
                    "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
                },
                {
                    "source_name": "ClearSky Siamesekitten August 2021",
                    "description": "ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.",
                    "url": "https://www.clearskysec.com/siamesekitten/"
                },
                {
                    "source_name": "Dragos Hexane",
                    "description": "Dragos. (n.d.). Hexane. Retrieved October 27, 2019.",
                    "url": "https://dragos.com/resource/hexane/"
                },
                {
                    "source_name": "Kaspersky Lyceum October 2021",
                    "description": "Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.",
                    "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
                },
                {
                    "source_name": "SecureWorks August 2019",
                    "description": "SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ",
                    "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:51.374Z",
            "name": "HEXANE",
            "description": "[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)",
            "aliases": [
                "HEXANE",
                "Lyceum",
                "Siamesekitten",
                "Spirlin"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.3",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence",
                "Mindaugas Gudzis, BT Security"
            ]
        },
        {
            "type": "intrusion-set",
            "spec_version": "2.1",
            "id": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/groups/G0064",
                    "external_id": "G0064"
                },
                {
                    "source_name": "APT33",
                    "description": "(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)"
                },
                {
                    "source_name": "HOLMIUM",
                    "description": "(Citation: Microsoft Holmium June 2020)"
                },
                {
                    "source_name": "Peach Sandstorm",
                    "description": "(Citation: Microsoft Threat Actor Naming July 2023)"
                },
                {
                    "source_name": "Elfin",
                    "description": "(Citation: Symantec Elfin Mar 2019)"
                },
                {
                    "source_name": "FireEye APT33 Webinar Sept 2017",
                    "description": "Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.",
                    "url": "https://www.brighttalk.com/webcast/10703/275683"
                },
                {
                    "source_name": "Microsoft Threat Actor Naming July 2023",
                    "description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
                    "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
                },
                {
                    "source_name": "Microsoft Holmium June 2020",
                    "description": "Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.",
                    "url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
                },
                {
                    "source_name": "FireEye APT33 Sept 2017",
                    "description": "O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
                },
                {
                    "source_name": "Symantec Elfin Mar 2019",
                    "description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.",
                    "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:52.730Z",
            "name": "APT33",
            "description": "[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)",
            "aliases": [
                "APT33",
                "HOLMIUM",
                "Elfin",
                "Peach Sandstorm"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
            "created": "2021-02-12T20:07:42.883Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0605",
                    "external_id": "S0605"
                },
                {
                    "source_name": "EKANS",
                    "description": "(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)(Citation: FireEye Ransomware Feb 2020)"
                },
                {
                    "source_name": "SNAKEHOSE",
                    "description": "(Citation: FireEye Ransomware Feb 2020)"
                },
                {
                    "source_name": "Dragos EKANS",
                    "description": "Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.",
                    "url": "https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
                },
                {
                    "source_name": "Palo Alto Unit 42 EKANS",
                    "description": "Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.",
                    "url": "https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/"
                },
                {
                    "source_name": "FireEye Ransomware Feb 2020",
                    "description": "Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.",
                    "url": "https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:37:51.908Z",
            "name": "EKANS",
            "description": "[EKANS](https://attack.mitre.org/software/S0605) is ransomware variant written in Golang that first appeared in mid-December 2019 and has been used against multiple sectors, including energy, healthcare, and automotive manufacturing, which in some cases resulted in significant operational disruptions. [EKANS](https://attack.mitre.org/software/S0605) has used a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy, Honeywell HMIWeb, etc), similar to those defined in [MegaCortex](https://attack.mitre.org/software/S0576).(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "EKANS",
                "SNAKEHOSE"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "created": "2017-05-31T21:32:59.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0093",
                    "external_id": "S0093"
                },
                {
                    "source_name": "Gigamon Berserk Bear October 2021",
                    "description": "Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.",
                    "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
                },
                {
                    "source_name": "Symantec Dragonfly Sept 2017",
                    "description": "Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.",
                    "url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
                },
                {
                    "source_name": "Symantec Dragonfly",
                    "description": "Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.",
                    "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:37:53.808Z",
            "name": "Backdoor.Oldrea",
            "description": "[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) is a modular backdoor that used by [Dragonfly](https://attack.mitre.org/groups/G0035) against energy companies since at least 2013. [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) was distributed via supply chain compromise, and included specialized modules to enumerate and map ICS-specific systems, processes, and protocols.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)(Citation: Symantec Dragonfly Sept 2017)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Backdoor.Oldrea",
                "Havex"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "created": "2020-12-14T17:34:58.457Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0603",
                    "external_id": "S0603"
                },
                {
                    "source_name": "W32.Stuxnet",
                    "description": "(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) "
                },
                {
                    "source_name": "CISA ICS Advisory ICSA-10-272-01",
                    "description": "CISA. (2010, September 10). ICS Advisory (ICSA-10-272-01). Retrieved December 7, 2020.",
                    "url": "https://us-cert.cisa.gov/ics/advisories/ICSA-10-272-01"
                },
                {
                    "source_name": "ESET Stuxnet Under the Microscope",
                    "description": "Matrosov, A., Rodionov, E., Harley, D., Malcho, J.. (n.d.). Stuxnet Under the Microscope. Retrieved December 7, 2020.",
                    "url": "https://web-assets.esetstatic.com/wls/2012/11/Stuxnet_Under_the_Microscope.pdf"
                },
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                },
                {
                    "source_name": "Langer Stuxnet",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved December 7, 2020.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-24T02:36:25.135Z",
            "name": "Stuxnet",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) was the first publicly reported malware to specifically target industrial control systems devices. [Stuxnet](https://attack.mitre.org/software/S0603) is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)(Citation: CISA ICS Advisory ICSA-10-272-01)(Citation: ESET Stuxnet Under the Microscope)(Citation: Langer Stuxnet) [Stuxnet](https://attack.mitre.org/software/S0603) was discovered in 2010, with some components being used as early as November 2008.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) ",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.5",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_aliases": [
                "Stuxnet",
                "W32.Stuxnet"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--1d8dccb3-e779-4702-aeb1-6627a22cc585",
            "created": "2017-05-31T21:33:21.973Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0001",
                    "external_id": "S1004"
                },
                {
                    "source_name": "ESET Win32/Industroyer",
                    "description": "Anton Cherepanov, ESET. (2017, June 12). Win32/Industroyer: A new threat for industrial control systems. Retrieved September 15, 2017.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride",
                    "description": "Dragos Inc.. (2017, June 13). Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations. Retrieved September 18, 2017.",
                    "url": "https://www.dragos.com/wp-content/uploads/CrashOverride-01.pdf"
                },
                {
                    "source_name": "CISA Alert TA17-163A CrashOverride June 2017",
                    "description": "CISA. (2017, June 12). Alert (TA17-163A). Retrieved October 22, 2019.",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA17-163A"
                },
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Dragos. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved October 14, 2019.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2019",
                    "description": "Joe Slowik. (2019, August 15). CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack. Retrieved October 22, 2019.",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:54.754Z",
            "name": "Industroyer",
            "description": "[Industroyer](https://collaborate.mitre.org/attackics/index.php/Software/S0001) is a sophisticated piece of malware designed to cause an [Impact](https://collaborate.mitre.org/attackics/index.php/Impact) to the working processes of Industrial Control Systems (ICS), specifically ICSs used in electrical substations.(Citation: ESET Win32/Industroyer) Industroyer was alleged to be used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride)(Citation: CISA Alert (TA17-163A))(Citation: Dragos Crashoverride 2018)(Citation: Dragos Crashoverride 2019)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Industroyer",
                "CRASHOVERRIDE"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--242622ca-3903-43d5-8aa0-3bbdaa3020ec",
            "created": "2017-05-31T21:32:59.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0005",
                    "external_id": "S1001"
                },
                {
                    "source_name": "ESET Bad Rabbit Oct 2017",
                    "description": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/",
                    "url": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"
                },
                {
                    "source_name": "Kaspersky Bad Rabbit Oct 2017",
                    "description": "Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov. (2017, October 27). Bad Rabbit Ransomware. Retrieved October 27, 2019.",
                    "url": "https://securelist.com/bad-rabbit-ransomware/82851/"
                },
                {
                    "source_name": "Dragos IT Ransomware for ICS Environments Apr 2019",
                    "description": "Joe Slowik. (2019, April 10). Implications of IT Ransomware for ICS Environments. Retrieved October 27, 2019.",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:54.935Z",
            "name": "Bad Rabbit",
            "description": "[Bad Rabbit](https://collaborate.mitre.org/attackics/index.php/Software/S0005) is a self-propagating (“wormable”) ransomware that affected the transportation sector in Ukraine. (Citation: ESET Bad Rabbit Oct 2017)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Bad Rabbit",
                "Diskcoder.D"
            ]
        },
        {
            "modified": "2025-01-02T19:45:31.402Z",
            "name": "Bad Rabbit",
            "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. [Bad Rabbit](https://attack.mitre.org/software/S0606) has also targeted organizations and consumers in Russia. (Citation: Secure List Bad Rabbit)(Citation: ESET Bad Rabbit)(Citation: Dragos Apr 2019)",
            "is_family": true,
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_aliases": [
                "Bad Rabbit",
                "Win32/Diskcoder.D"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "created": "2021-02-09T14:35:39.455Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0606",
                    "external_id": "S0606"
                },
                {
                    "source_name": "Dragos Apr 2019",
                    "description": "Joe Slowik. (2019, April 10). Implications of IT Ransomware for ICS Environments. Retrieved October 27, 2019.",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                },
                {
                    "source_name": "ESET Bad Rabbit",
                    "description": "M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.",
                    "url": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"
                },
                {
                    "source_name": "Secure List Bad Rabbit",
                    "description": "Mamedov, O. Sinitsyn, F.  Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.",
                    "url": "https://securelist.com/bad-rabbit-ransomware/82851/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--496bff4d-0700-4b28-b06f-f30a63002be7",
            "created": "2019-03-26T15:02:14.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0010",
                    "external_id": "S1008"
                },
                {
                    "source_name": "Wired W32.Stuxnet Dossier Feb 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier (Version 1.4). Retrieved September 22, 2017.",
                    "url": "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf"
                },
                {
                    "source_name": "Symantec W32.Stuxnet Writeup",
                    "description": "Jarrad Shearer. (n.d.). W32.Stuxnet Writeup. Retrieved October 22, 2019.",
                    "url": "https://www.symantec.com/security-center/writeup/2010-071400-3123-99"
                },
                {
                    "source_name": "CISA ICS Advisory ICSA-10-238-01B Stuxnet January 2014",
                    "description": "CISA. (2014, January 08). Stuxnet Malware Mitigation (Update B). Retrieved October 22, 2019.",
                    "url": "https://www.us-cert.gov/ics/advisories/ICSA-10-238-01B"
                },
                {
                    "source_name": "SCADAhacker Stuxnet Mitigation Jan 2014",
                    "description": "Joel Langill. (2014, January 21). Stuxnet Mitigation. Retrieved October 22, 2019.",
                    "url": "https://scadahacker.com/resources/stuxnet-mitigation.html"
                },
                {
                    "source_name": "Langer Stuxnet Analysis Nov 2013",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved March 27, 2018.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:55.125Z",
            "name": "Stuxnet",
            "description": "[Stuxnet](https://collaborate.mitre.org/attackics/index.php/Software/S0010) was the first publicly reported piece of malware to specifically target industrial control systems devices. Stuxnet is a large and complex piece of malware that utilized multiple different complex tactics including multiple zero-day vulnerabilites, a sophisticated Windows rootkit, and network infection routines.(Citation: Wired W32.Stuxnet Dossier Feb 2011)(Citation: Symantec W32.Stuxnet Writeup)(Citation: CISA ICS Advisory (ICSA-10-238-01B))(Citation: SCADAhacker Stuxnet Mitigation Jan 2014)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Stuxnet"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--49c04994-1035-4b58-89b7-cf8956e3b423",
            "created": "2017-05-31T21:32:59.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0012",
                    "external_id": "S1003"
                },
                {
                    "source_name": "Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary",
                    "description": "Catalin Cimpanu. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved October 14, 2019.",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                },
                {
                    "source_name": "Symantec Conficker Jun 2015",
                    "description": "Symantec. (2015, June 30). Simple steps to protect yourself from the Conficker Worm. Retrieved December 5, 2019.",
                    "url": "https://support.symantec.com/us/en/article.tech93179.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:55.301Z",
            "name": "Conficker",
            "description": "[Conficker](https://collaborate.mitre.org/attackics/index.php/Software/S0012) is a computer worm that targets Microsoft Windows and was first detected in November 2008. It targets a vulnerability (MS08-067) in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet. Conficker made its way onto computers and removable disk drives in a nuclear power plant. (Citation: Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Conficker",
                "Downadup",
                "Kido"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "created": "2019-03-26T15:02:14.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1006",
                    "external_id": "S1006"
                },
                {
                    "source_name": "Spenneberg, Ralf 2016",
                    "description": "Spenneberg, Ralf 2016 PLC-Blaster Retrieved. 2019/06/06 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf"
                },
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.733Z",
            "name": "PLC-Blaster",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) is a piece of proof-of-concept malware that runs on Siemens S7 PLCs. This worm locates other Siemens S7 PLCs on the network and attempts to infect them.  Once this worm has infected its target and attempted to infect other devices on the network, the worm can then run one of many modules. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016) (Citation: Spenneberg, Ralf 2016) ",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_aliases": [
                "PLC-Blaster"
            ]
        },
        {
            "modified": "2023-10-06T14:08:40.134Z",
            "name": "BlackEnergy",
            "description": "[BlackEnergy](https://attack.mitre.org/software/S0089) is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3. (Citation: F-Secure BlackEnergy 2014)",
            "is_family": true,
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.4",
            "x_mitre_aliases": [
                "BlackEnergy",
                "Black Energy"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "created": "2017-05-31T21:32:57.807Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0089",
                    "external_id": "S0089"
                },
                {
                    "source_name": "F-Secure BlackEnergy 2014",
                    "description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
                    "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
            "created": "2019-03-26T15:02:14.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0368",
                    "external_id": "S0368"
                },
                {
                    "source_name": "ExPetr",
                    "description": "(Citation: ESET Telebots June 2017)"
                },
                {
                    "source_name": "Diskcoder.C",
                    "description": "(Citation: ESET Telebots June 2017)"
                },
                {
                    "source_name": "GoldenEye",
                    "description": "(Citation: Talos Nyetya June 2017)"
                },
                {
                    "source_name": "Nyetya",
                    "description": "(Citation: Talos Nyetya June 2017)"
                },
                {
                    "source_name": "Petrwrap",
                    "description": "(Citation: Talos Nyetya June 2017)(Citation: ESET Telebots June 2017)"
                },
                {
                    "source_name": "ESET Telebots June 2017",
                    "description": "Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.",
                    "url": "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"
                },
                {
                    "source_name": "Talos Nyetya June 2017",
                    "description": "Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.",
                    "url": "https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                },
                {
                    "source_name": "US-CERT NotPetya 2017",
                    "description": "US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA17-181A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:38:09.202Z",
            "name": "NotPetya",
            "description": "[NotPetya](https://attack.mitre.org/software/S0368) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) in a worldwide attack starting on June 27, 2017. While [NotPetya](https://attack.mitre.org/software/S0368) appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "NotPetya",
                "ExPetr",
                "Diskcoder.C",
                "GoldenEye",
                "Petrwrap",
                "Nyetya"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
            "created": "2021-02-23T20:50:32.845Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0608",
                    "external_id": "S0608"
                },
                {
                    "source_name": "Kido",
                    "description": "(Citation: SANS Conficker) "
                },
                {
                    "source_name": "Downadup",
                    "description": "(Citation: SANS Conficker) "
                },
                {
                    "source_name": "SANS Conficker",
                    "description": "Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.",
                    "url": "https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"
                },
                {
                    "source_name": "Conficker Nuclear Power Plant",
                    "description": "Cimpanu, C. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved February 18, 2021.",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:38:10.239Z",
            "name": "Conficker",
            "description": "[Conficker](https://attack.mitre.org/software/S0608) is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.(Citation: SANS Conficker) In 2016, a variant of [Conficker](https://attack.mitre.org/software/S0608) made its way on computers and removable disk drives belonging to a nuclear power plant.(Citation: Conficker Nuclear Power Plant)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Conficker",
                "Kido",
                "Downadup"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "created": "2019-04-16T19:00:49.435Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0372",
                    "external_id": "S0372"
                },
                {
                    "source_name": "CarbonBlack LockerGoga 2019",
                    "description": "CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.",
                    "url": "https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"
                },
                {
                    "source_name": "Unit42 LockerGoga 2019",
                    "description": "Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.",
                    "url": "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.733Z",
            "name": "LockerGoga",
            "description": "[LockerGoga](https://attack.mitre.org/software/S0372) is ransomware that was first reported in January 2019, and has been tied to various attacks on European companies, including industrial and manufacturing firms.(Citation: Unit42 LockerGoga 2019)(Citation: CarbonBlack LockerGoga 2019)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Joe Slowik - Dragos"
            ],
            "x_mitre_aliases": [
                "LockerGoga"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--6108f800-10b8-4090-944e-be579f01263d",
            "created": "2019-03-26T15:02:14.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1010",
                    "external_id": "S1010"
                },
                {
                    "source_name": "Carl Hurd March 2019",
                    "description": "Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 ",
                    "url": "https://www.youtube.com/watch?v=yuZazP22rpI"
                },
                {
                    "source_name": "NCSC CISA Cyclops Blink Advisory February 2022",
                    "description": "NCSC, CISA, FBI, NSA. (2022, February 23). New Sandworm malware Cyclops Blink replaces VPNFilter. Retrieved March 3, 2022.",
                    "url": "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
                },
                {
                    "source_name": "William Largent June 2018",
                    "description": "William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 ",
                    "url": "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-15T19:46:34.471Z",
            "name": "VPNFilter",
            "description": "[VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) [VPNFilter](https://attack.mitre.org/software/S1010) was assessed to be replaced by [Sandworm Team](https://attack.mitre.org/groups/G0034) with [Cyclops Blink](https://attack.mitre.org/software/S0687) starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Network Devices",
                "Linux"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "VPNFilter"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--68dca94f-c11d-421e-9287-7c501108e18c",
            "created": "2017-05-31T21:32:31.188Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0038",
                    "external_id": "S0038"
                },
                {
                    "source_name": "Symantec W32.Duqu",
                    "description": "Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.",
                    "url": "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:38:14.352Z",
            "name": "Duqu",
            "description": "[Duqu](https://attack.mitre.org/software/S0038) is a malware platform that uses a modular approach to extend functionality after deployment within a target network. (Citation: Symantec W32.Duqu)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Duqu"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "created": "2023-03-30T19:20:45.556Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1072",
                    "external_id": "S1072"
                },
                {
                    "source_name": "Industroyer2 Blackhat ESET",
                    "description": "Anton Cherepanov, Robert Lipovsky. (2022, August). Industroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid. Retrieved April 6, 2023.",
                    "url": "https://www.youtube.com/watch?v=xC9iM5wVedQ"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:38:14.728Z",
            "name": "Industroyer2",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) is a compiled and static piece of malware that has the ability to communicate over the IEC-104 protocol. It is similar to the IEC-104 module found in [Industroyer](https://attack.mitre.org/software/S0604). Security researchers assess that [Industroyer2](https://attack.mitre.org/software/S1072) was designed to cause impact to high-voltage electrical substations. The initial [Industroyer2](https://attack.mitre.org/software/S1072) sample was compiled on 03/23/2022 and scheduled to execute on 04/08/2022, however it was discovered before deploying, resulting in no impact.(Citation: Industroyer2 Blackhat ESET)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Field Controller/RTU/PLC/IED",
                "Engineering Workstation"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Industroyer2"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--736a3b71-eccc-48b7-b5ed-adb2b74ca830",
            "created": "2017-05-31T21:33:21.973Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0016",
                    "external_id": "S1005"
                },
                {
                    "source_name": "ESET BlackEnergy Jan 2016",
                    "description": "Anton Cherepanov. (n.d.). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved October 29, 2019.",
                    "url": "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
                },
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (n.d.). When The Lights Went Out. Retrieved October 22, 2019.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:55.503Z",
            "name": "Killdisk",
            "description": "In 2015 the BlackEnergy malware contained a component called KillDisk. KillDisk's main functionality is to overwrite files with random data, rendering the OS unbootable. (Citation: ESET BlackEnergy Jan 2016)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Killdisk"
            ]
        },
        {
            "modified": "2024-12-09T02:29:13.859Z",
            "name": "WannaCry",
            "description": "[WannaCry](https://attack.mitre.org/software/S0366) is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.(Citation: LogRhythm WannaCry)(Citation: US-CERT WannaCry 2017)(Citation: Washington Post WannaCry 2017)(Citation: FireEye WannaCry 2017)",
            "is_family": true,
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_contributors": [
                "Jan Miller, CrowdStrike"
            ],
            "x_mitre_aliases": [
                "WannaCry",
                "WanaCry",
                "WanaCrypt",
                "WanaCrypt0r",
                "WCry"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
            "created": "2019-03-25T17:30:17.004Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0366",
                    "external_id": "S0366"
                },
                {
                    "source_name": "WanaCrypt0r",
                    "description": "(Citation: LogRhythm WannaCry)"
                },
                {
                    "source_name": "WCry",
                    "description": "(Citation: LogRhythm WannaCry)(Citation: SecureWorks WannaCry Analysis)"
                },
                {
                    "source_name": "WanaCry",
                    "description": "(Citation: SecureWorks WannaCry Analysis)"
                },
                {
                    "source_name": "WanaCrypt",
                    "description": "(Citation: SecureWorks WannaCry Analysis)"
                },
                {
                    "source_name": "FireEye WannaCry 2017",
                    "description": "Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
                },
                {
                    "source_name": "SecureWorks WannaCry Analysis",
                    "description": "Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.",
                    "url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
                },
                {
                    "source_name": "Washington Post WannaCry 2017",
                    "description": "Dwoskin, E. and Adam, K. (2017, May 14). More than 150 countries affected by massive cyberattack, Europol says. Retrieved March 25, 2019.",
                    "url": "https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4"
                },
                {
                    "source_name": "LogRhythm WannaCry",
                    "description": "Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved December 8, 2024.",
                    "url": "https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"
                },
                {
                    "source_name": "US-CERT WannaCry 2017",
                    "description": "US-CERT. (2017, May 12). Alert (TA17-132A): Indicators Associated With WannaCry Ransomware. Retrieved March 25, 2019.",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA17-132A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "created": "2019-03-26T15:02:14.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1009",
                    "external_id": "S1009"
                },
                {
                    "source_name": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                },
                {
                    "source_name": "Dragos December 2017",
                    "description": "Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 ",
                    "url": "https://dragos.com/blog/trisis/TRISIS-01.pdf"
                },
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                },
                {
                    "source_name": "Julian Gutmanis March 2019",
                    "description": "Julian Gutmanis 2019, March 11 Triton - A Report From The Trenches Retrieved. 2019/03/11 ",
                    "url": "https://www.youtube.com/watch?v=XwSJ8hloGvY"
                },
                {
                    "source_name": "Schneider December 2018",
                    "description": "Schneider 2018, December 14 Security Notification  EcoStruxure Triconex Tricon V3 Retrieved. 2019/03/08 ",
                    "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2017-347-01+Triconex+V3.pdf&p_Doc_Ref=SEVD-2017-347-01"
                },
                {
                    "source_name": "Schneider Electric January 2018",
                    "description": "Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 ",
                    "url": "https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.736Z",
            "name": "Triton",
            "description": "[Triton](https://attack.mitre.org/software/S1009) is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers.(Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017)(Citation: Dragos December 2017)(Citation: DHS CISA February 2019)(Citation: Schneider Electric January 2018)(Citation: Julian Gutmanis March 2019)(Citation: Schneider December 2018)(Citation: Jos Wetzels January 2018)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_aliases": [
                "Triton",
                "TRISIS",
                "HatMan"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--89ab0ca5-f7e0-4d16-bf2a-17d68117fa4b",
            "created": "2017-05-31T21:32:59.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0004",
                    "external_id": "S1002"
                },
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (n.d.). When The Lights Went Out. Retrieved October 22, 2019.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:55.679Z",
            "name": "BlackEnergy 3",
            "description": "[BlackEnergy 3](https://collaborate.mitre.org/attackics/index.php/Software/S0004) is a malware toolkit that has been used by both criminal and APT actors. It support various plug-ins including a variant of KillDisk. It is known to have been used against the Ukrainian power grid. (Citation: Booz Allen Hamilton)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "BlackEnergy 3"
            ]
        },
        {
            "modified": "2024-09-12T14:43:31.224Z",
            "name": "Fuxnet",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) is malware designed to impact the industrial network infrastructure managing control system sensors for utility operations in Moscow. [Fuxnet](https://attack.mitre.org/software/S1157) is linked to an entity referred to as the Blackjack hacking group, which is assessed to be linked to Ukrainian intelligence services.(Citation: Claroty Fuxnet 2024)",
            "is_family": true,
            "x_mitre_platforms": [
                "Input/Output Server",
                "Control Server"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_contributors": [
                "Sharon Brizinov, Claroty Team82 Research"
            ],
            "x_mitre_aliases": [
                "Fuxnet"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "created": "2024-09-11T22:47:34.585Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1157",
                    "external_id": "S1157"
                },
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--9e3c9495-5fbd-4676-b3ac-ddecceb57b8f",
            "created": "2021-04-13T12:28:31.188Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://collaborate.mitre.org/attackics/index.php/Software/S0017",
                    "external_id": "S0017"
                },
                {
                    "source_name": "Forbes Snake Ransomware June 2020",
                    "description": "Davey Winder. (2020, June 10). Honda Hacked: Japanese Car Giant Confirms Cyber Attack On Global Operations. Retrieved April 12, 2021.",
                    "url": "https://www.forbes.com/sites/daveywinder/2020/06/10/honda-hacked-japanese-car-giant-confirms-cyber-attack-on-global-operations-snake-ransomware/?sh=2725c35753ad"
                },
                {
                    "source_name": "MalwareByes Honda and Enel Ransomware June 2020",
                    "description": "MalwareBytes. (2020, June 09). Honda and Enel impacted by cyber attack suspected to be ransomware. Retrieved April 12, 2021.",
                    "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/honda-and-enel-impacted-by-cyber-attack-suspected-to-be-ransomware/"
                },
                {
                    "source_name": "Dragos EKANS February 2020",
                    "description": "Dragos Threat Intelligence. (2020, February 03). EKANS Ransomware and ICS Operations. Retrieved April 12, 2021.",
                    "url": "https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
                },
                {
                    "source_name": "FireEye OT Ransomware July 2020",
                    "description": "Nathan Brubaker, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Corey Hildebrandt. (2020, July 15). Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families. Retrieved April 12, 2021.",
                    "url": "https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html"
                },
                {
                    "source_name": "Pylos January 2020",
                    "description": "Joe Slowik. (2020, January 28). Getting the Story Right, and Why It Matters. Retrieved April 12, 2021.",
                    "url": "https://pylos.co/2020/01/28/getting-the-story-right-and-why-it-matters/"
                },
                {
                    "source_name": "Dragos EKANS June 2020",
                    "description": "Joe Slowik. (2020, June 18). EKANS Ransomware Misconceptions and Misunderstandings. Retrieved April 12, 2021.",
                    "url": "https://www.dragos.com/blog/industry-news/ekans-ransomware-misconceptions-and-misunderstandings/#_edn7"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-18T18:00:55.859Z",
            "name": "EKANS",
            "description": "[EKANS](https://collaborate.mitre.org/attackics/index.php/Software/S0017) is ransomware that was first seen December 2019 and later reported to have impacted operations at Honda automotive production facilities.(Citation: Forbes Snake Ransomware June 2020)(Citation: MalwareByes Honda and Enel Ransomware June 2020)(Citation: Dragos EKANS February 2020) EKANS has a hard-coded kill-list of processes, including some associated with common ICS software platforms (e.g., GE Proficy historian, Honeywell HMIWeb).(Citation: Dragos EKANS February 2020) If the malware discovers these processes on the target system, it will stop, encrypt, and rename the process to prevent the program from restarting. This malware should not be confused with the “Snake” malware associated with the Turla group. The ICS processes documented within the malware’s kill-list is similar to those defined by the MEGACORTEX software.(Citation: FireEye OT Ransomware July 2020)(Citation: Pylos January 2020)(Citation: Dragos EKANS June 2020)The ransomware was initially reported as “Snake”, however, to avoid confusion with the unrelated Turla APT group security researchers spelled it backwards as EKANS.",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "EKANS",
                "SNAKEHOSE"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--a020a61c-423f-4195-8c46-ba1d21abba37",
            "created": "2020-05-13T20:14:53.171Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0446",
                    "external_id": "S0446"
                },
                {
                    "source_name": "Ryuk",
                    "description": "(Citation: CrowdStrike Ryuk January 2019) (Citation: Bleeping Computer - Ryuk WoL) "
                },
                {
                    "source_name": "Bleeping Computer - Ryuk WoL",
                    "description": "Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.",
                    "url": "https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/"
                },
                {
                    "source_name": "FireEye Ryuk and Trickbot January 2019",
                    "description": "Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
                },
                {
                    "source_name": "CrowdStrike Ryuk January 2019",
                    "description": "Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.",
                    "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
                },
                {
                    "source_name": "FireEye FIN6 Apr 2019",
                    "description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-22T22:21:23.589Z",
            "name": "Ryuk",
            "description": "[Ryuk](https://attack.mitre.org/software/S0446) is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. [Ryuk](https://attack.mitre.org/software/S0446) shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.4",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Matt Brenton, Zurich Insurance Group",
                "The DFIR Report"
            ],
            "x_mitre_aliases": [
                "Ryuk"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--a4a98eab-b691-45d9-8c48-869ef8fefd57",
            "created": "2017-05-31T21:32:59.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1000",
                    "external_id": "S1000"
                },
                {
                    "source_name": "ESET",
                    "description": "ESET   ACAD/Medre.A: 10000s of AutoCAD Designs Leaked in Suspected Industrial Espionage Retrieved. 2021/04/13 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/200x/white-papers/ESET_ACAD_Medre_A_whitepaper.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:25.077Z",
            "name": "ACAD/Medre.A",
            "description": "[ACAD/Medre.A](https://attack.mitre.org/software/S1000) is a worm that steals operational information. The worm collects AutoCAD files with drawings. [ACAD/Medre.A](https://attack.mitre.org/software/S1000) has the capability to be used for industrial espionage.(Citation: ESET)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "ACAD/Medre.A"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "created": "2020-08-04T15:06:14.796Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0496",
                    "external_id": "S0496"
                },
                {
                    "source_name": "Sodin",
                    "description": "(Citation: Intel 471 REvil March 2020)(Citation: Kaspersky Sodin July 2019)"
                },
                {
                    "source_name": "Sodinokibi",
                    "description": "(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Talos Sodinokibi April 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee REvil October 2019)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)(Citation: Tetra Defense Sodinokibi March 2020)"
                },
                {
                    "source_name": "Talos Sodinokibi April 2019",
                    "description": "Cadieux, P, et al (2019, April 30). Sodinokibi ransomware exploits WebLogic Server vulnerability. Retrieved August 4, 2020.",
                    "url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
                },
                {
                    "source_name": "Secureworks REvil September 2019",
                    "description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                },
                {
                    "source_name": "Cylance Sodinokibi July 2019",
                    "description": "Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
                },
                {
                    "source_name": "Group IB Ransomware May 2020",
                    "description": "Group IB. (2020, May). Ransomware Uncovered: Attackers’ Latest Methods. Retrieved August 5, 2020.",
                    "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
                },
                {
                    "source_name": "G Data Sodinokibi June 2019",
                    "description": "Han, Karsten. (2019, June 4). Strange Bits: Sodinokibi Spam, CinaRAT, and Fake G DATA. Retrieved August 4, 2020.",
                    "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
                },
                {
                    "source_name": "Intel 471 REvil March 2020",
                    "description": "Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.",
                    "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
                },
                {
                    "source_name": "Kaspersky Sodin July 2019",
                    "description": "Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.",
                    "url": "https://securelist.com/sodin-ransomware/91473/"
                },
                {
                    "source_name": "McAfee Sodinokibi October 2019",
                    "description": "McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
                },
                {
                    "source_name": "Picus Sodinokibi January 2020",
                    "description": "Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.",
                    "url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
                },
                {
                    "source_name": "McAfee REvil October 2019",
                    "description": "Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo. Retrieved August 5, 2020.",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"
                },
                {
                    "source_name": "Secureworks GandCrab and REvil September 2019",
                    "description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
                },
                {
                    "source_name": "Tetra Defense Sodinokibi March 2020",
                    "description": "Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-22T02:14:27.600Z",
            "name": "REvil",
            "description": "[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.3",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Edward Millington"
            ],
            "x_mitre_aliases": [
                "REvil",
                "Sodin",
                "Sodinokibi"
            ]
        },
        {
            "modified": "2024-11-20T23:33:20.890Z",
            "name": "FrostyGoop",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) is a Windows-based binary written in Golang that allows for interaction with industrial control system (ICS) equipment via Modbus TCP over port 502. [FrostyGoop](https://attack.mitre.org/software/S1165) allows for reading and writing data to holding registers on targeted devices, manipulating the operation of systems for malicious purposes. [FrostyGoop](https://attack.mitre.org/software/S1165) is associated with the [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) in Ukraine.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
            "is_family": true,
            "x_mitre_platforms": [
                "Control Server",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_aliases": [
                "FrostyGoop",
                "BUSTLEBERM"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "created": "2024-11-20T23:02:16.588Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1165",
                    "external_id": "S1165"
                },
                {
                    "source_name": "BUSTLEBERM",
                    "description": "(Citation: Nozomi BUSTLEBERM 2024)"
                },
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                },
                {
                    "source_name": "Nozomi BUSTLEBERM 2024",
                    "description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
                    "url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "created": "2022-09-28T20:07:40.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S1045",
                    "external_id": "S1045"
                },
                {
                    "source_name": "PIPEDREAM",
                    "description": "(Citation: Dragos-Pipedream)(Citation: Wylie-22)"
                },
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                },
                {
                    "source_name": "Dragos-Pipedream",
                    "description": "DRAGOS. (2022, April 13). Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                },
                {
                    "source_name": "Brubaker-Incontroller",
                    "description": "Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
                },
                {
                    "source_name": "Schneider-Incontroller",
                    "description": "Schneider Electric. (2022, April 14). Schneider Electric Security Bulletin: “APT Cyber Tools Targeting ICS/SCADA Devices” . Retrieved September 28, 2022.",
                    "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2022-01"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.739Z",
            "name": "INCONTROLLER",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. [INCONTROLLER](https://attack.mitre.org/software/S1045) has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed [INCONTROLLER](https://attack.mitre.org/software/S1045) was developed by CHERNOVITE.(Citation: CISA-AA22-103A)(Citation: Brubaker-Incontroller)(Citation: Dragos-Pipedream)(Citation: Schneider-Incontroller)(Citation: Wylie-22) ",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Engineering Workstation",
                "Field Controller/RTU/PLC/IED",
                "Safety Instrumented System/Protection Relay",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Jimmy Wylie, Dragos, Inc."
            ],
            "x_mitre_aliases": [
                "INCONTROLLER",
                "PIPEDREAM"
            ]
        },
        {
            "modified": "2023-10-06T14:09:52.833Z",
            "name": "KillDisk",
            "description": "[KillDisk](https://attack.mitre.org/software/S0607) is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of [BlackEnergy](https://attack.mitre.org/software/S0089) malware during cyber attacks against Ukraine in 2015. [KillDisk](https://attack.mitre.org/software/S0607) has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some [KillDisk](https://attack.mitre.org/software/S0607) variants.(Citation: KillDisk Ransomware)(Citation: ESEST Black Energy Jan 2016)(Citation: Trend Micro KillDisk 1)(Citation: Trend Micro KillDisk 2)",
            "is_family": true,
            "x_mitre_platforms": [
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_aliases": [
                "KillDisk",
                "Win32/KillDisk.NBI",
                "Win32/KillDisk.NBH",
                "Win32/KillDisk.NBD",
                "Win32/KillDisk.NBC",
                "Win32/KillDisk.NBB"
            ],
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "created": "2021-01-20T18:05:07.059Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0607",
                    "external_id": "S0607"
                },
                {
                    "source_name": "KillDisk Ransomware",
                    "description": "Catalin Cimpanu. (2016, December 29). KillDisk Disk-Wiping Malware Adds Ransomware Component. Retrieved January 12, 2021.",
                    "url": "https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/"
                },
                {
                    "source_name": "ESEST Black Energy Jan 2016",
                    "description": "Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.",
                    "url": "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
                },
                {
                    "source_name": "Trend Micro KillDisk 1",
                    "description": "Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021.",
                    "url": "https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"
                },
                {
                    "source_name": "Trend Micro KillDisk 2",
                    "description": "Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.",
                    "url": "https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "created": "2021-01-04T20:42:21.997Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0604",
                    "external_id": "S0604"
                },
                {
                    "source_name": "CRASHOVERRIDE",
                    "description": "(Citation: Dragos Crashoverride 2017)"
                },
                {
                    "source_name": "Win32/Industroyer",
                    "description": "(Citation: ESET Industroyer)"
                },
                {
                    "source_name": "ESET Industroyer",
                    "description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2017",
                    "description": "Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.",
                    "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.739Z",
            "name": "Industroyer",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.(Citation: ESET Industroyer) [Industroyer](https://attack.mitre.org/software/S0604) was used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride 2017) This is the first publicly known malware specifically designed to target and impact operations in the electric grid.(Citation: Dragos Crashoverride 2018)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence",
                "Joe Slowik - Dragos"
            ],
            "x_mitre_aliases": [
                "Industroyer",
                "CRASHOVERRIDE",
                "Win32/Industroyer"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--ff6840c9-4c87-4d07-bbb6-9f50aa33d498",
            "created": "2017-05-31T21:33:21.973Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0143",
                    "external_id": "S0143"
                },
                {
                    "source_name": "Flame",
                    "description": "(Citation: Kaspersky Flame)"
                },
                {
                    "source_name": "sKyWIper",
                    "description": "(Citation: Kaspersky Flame) (Citation: Crysys Skywiper)"
                },
                {
                    "source_name": "Flamer",
                    "description": "(Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice)"
                },
                {
                    "source_name": "Kaspersky Flame",
                    "description": "Gostev, A. (2012, May 28). The Flame: Questions and Answers. Retrieved March 1, 2017.",
                    "url": "https://securelist.com/the-flame-questions-and-answers-51/34344/"
                },
                {
                    "source_name": "Crysys Skywiper",
                    "description": "sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer):  A complex malware for targeted attacks. Retrieved September 6, 2018.",
                    "url": "https://www.crysys.hu/publications/files/skywiper.pdf"
                },
                {
                    "source_name": "Symantec Beetlejuice",
                    "description": "Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017.",
                    "url": "https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T20:38:46.014Z",
            "name": "Flame",
            "description": "[Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_aliases": [
                "Flame",
                "Flamer",
                "sKyWIper"
            ]
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--199f5568-ca25-4892-b7a5-870503e4d0f4",
            "created": "2026-09-02T19:34:22.932Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0064",
                    "external_id": "C0064"
                },
                {
                    "source_name": "AI-Mexico-Govt-Compromise",
                    "description": "Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:56:40.965Z",
            "name": "AI-Assisted Breach of Mexico's Government Infrastructure",
            "description": "The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.(Citation: AI-Mexico-Govt-Compromise) ",
            "aliases": [
                "AI-Assisted Breach of Mexico's Government Infrastructure"
            ],
            "first_seen": "2025-12-01T05:00:00.000Z",
            "last_seen": "2026-02-01T05:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: AI-Mexico-Govt-Compromise)",
            "x_mitre_last_seen_citation": "(Citation: AI-Mexico-Govt-Compromise)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "course-of-action",
            "spec_version": "2.1",
            "id": "course-of-action--945271ef-52cd-4a2c-a4cd-09edda7ffbab",
            "created": "2026-10-08T02:15:01.856Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/mitigations/M1061",
                    "external_id": "M1061"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T16:01:24.197Z",
            "name": "Limit Software/Package Installation",
            "description": "Prevent unauthorized installation of software on ICS assets. ",
            "labels": [
                "IEC 62443-3-3:2013 - SR 3.4",
                "IEC 62443-4-2:2019 - CR 3.4",
                "NIST SP 800-53 Rev. 5 - CM-7"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--ab183324-4634-45bc-98af-9458bb94bcef",
            "created": "2026-09-02T20:19:46.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S9045",
                    "external_id": "S9045"
                },
                {
                    "source_name": "AI-Mexico-Govt-Compromise",
                    "description": "Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:56:40.966Z",
            "name": "BACKUPOSINT v9.0 APEX PREDATOR",
            "description": "[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) is a 49-module Python malware developed entirely by Anthropic’s Claude Code as part of the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) campaign. [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) leverages publicly available techniques for network enumeration, credential harvesting, Active Directory interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement (Citation: AI-Mexico-Govt-Compromise). ",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "IaaS",
                "Containers"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_aliases": [
                "BACKUPOSINT v9.0 APEX PREDATOR"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
            "created": "2026-09-02T20:33:19.300Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S9046",
                    "external_id": "S9046"
                },
                {
                    "source_name": "Claroty-IOCONTROL",
                    "description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
                    "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
                },
                {
                    "source_name": "Dragos 2025 Year in Review",
                    "description": "Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
                },
                {
                    "source_name": "Armis-IOCONTROL",
                    "description": "Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.",
                    "url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-12T16:09:31.637Z",
            "name": "IOControl",
            "description": "IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)",
            "is_family": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_aliases": [
                "IOControl"
            ]
        },
        {
            "type": "campaign",
            "spec_version": "2.1",
            "id": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "created": "2026-10-08T21:32:18.464Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/campaigns/C0066",
                    "external_id": "C0066"
                },
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T14:29:13.954Z",
            "name": "2026 U.S. Water Utilities Attacks",
            "description": "[2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066) was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater) The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack) At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater) The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.(Citation: Dragos Water Under Attack)",
            "aliases": [
                "2026 U.S. Water Utilities Attacks",
                "2026 Water Utilities Attacks"
            ],
            "first_seen": "2026-07-01T04:00:00.000Z",
            "last_seen": "2026-07-01T04:00:00.000Z",
            "x_mitre_first_seen_citation": "(Citation: FBI Water and Wastewater)",
            "x_mitre_last_seen_citation": "(Citation: Dragos Water Under Attack)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0803",
                    "external_id": "T0803"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:37.791Z",
            "name": "Block Command Message",
            "description": "Adversaries may block a command message from reaching its intended target to prevent command execution. In OT networks, command messages are sent to provide instructions to control system devices. A blocked command message can inhibit response functions from correcting a disruption or unsafe condition. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)  (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0881",
                    "external_id": "T0881"
                },
                {
                    "source_name": "Enterprise ATT&CK",
                    "description": "Enterprise ATT&CK Enterprise ATT&CK   Service Stop Retrieved. 2019/10/29  Service Stop Retrieved. 2019/10/29 ",
                    "url": "https://attack.mitre.org/techniques/T1489/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:44.278Z",
            "name": "Service Stop",
            "description": "Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. (Citation: Enterprise ATT&CK)  Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. (Citation: Enterprise ATT&CK)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0836",
                    "external_id": "T0836"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:47.174Z",
            "name": "Modify Parameter",
            "description": "Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.      \n\nAn adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause [Impact](https://attack.mitre.org/tactics/TA0105) to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.3"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0821",
                    "external_id": "T0821"
                },
                {
                    "source_name": "IEC February 2013",
                    "description": "IEC 2013, February 20 IEC 61131-3:2013  Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 ",
                    "url": "https://webstore.iec.ch/publication/4552"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:38.152Z",
            "name": "Modify Controller Tasking",
            "description": "Adversaries may modify the tasking of a controller to allow for the execution of their own programs. This can allow an adversary to manipulate the execution flow and behavior of a controller. \n\nAccording to 61131-3, the association of a Task with a Program Organization Unit (POU) defines a task association. (Citation: IEC February 2013) An adversary may modify these associations or create new ones to manipulate the execution flow of a controller. Modification of controller tasking can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append.\n\nTasks have properties, such as interval, frequency and priority to meet the requirements of program execution. Some controller vendors implement tasks with implicit, pre-defined properties whereas others allow for these properties to be formulated explicitly. An adversary may associate their program with tasks that have a higher priority or execute associated programs more frequently. For instance, to ensure cyclic execution of their program on a Siemens controller, an adversary may add their program to the task, Organization Block 1 (OB1).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0887",
                    "external_id": "T0887"
                },
                {
                    "source_name": "Bastille April 2017",
                    "description": "Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 ",
                    "url": "https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack"
                },
                {
                    "source_name": "Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018",
                    "description": "Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. 2018, April Guide to Industrial Wireless Systems Deployments Retrieved. 2020/12/01 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/ams/NIST.AMS.300-4.pdf"
                },
                {
                    "source_name": "Gallagher, S. April 2017",
                    "description": "Gallagher, S. 2017, April 12 Pirate radio: Signal spoof set off Dallas emergency sirens, not network hack Retrieved. 2020/12/01 ",
                    "url": "https://arstechnica.com/information-technology/2017/04/dallas-siren-hack-used-radio-signals-to-spoof-alarm-says-city-manager/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:38.761Z",
            "name": "Wireless Sniffing",
            "description": "Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments. RF communication frequencies vary between 3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018)  The wavelength and frequency of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the type of radio required to capture them. These characteristics are often standardized in the protocol and hardware and may have an effect on how the signal is captured. Some examples of wireless protocols that may be found in cyber-physical environments are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety Spectrum. \n\nAdversaries may capture RF communications by using specialized hardware, such as software defined radio (SDR), handheld radio, or a computer with radio demodulator tuned to the communication frequency. (Citation: Bastille April 2017) Information transmitted over a wireless medium may be captured in-transit whether the sniffing device is the intended destination or not. This technique may be particularly useful to an adversary when the communications are not encrypted. (Citation: Gallagher, S. April 2017) \n\nIn the 2017 Dallas Siren incident, it is suspected that adversaries likely captured wireless command message broadcasts on a 700 MHz frequency during a regular test of the system. These messages were later replayed to trigger the alarm systems. (Citation: Gallagher, S. April 2017)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "ICSCoE Japan"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0829",
                    "external_id": "T0829"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.621Z",
            "name": "Loss of View",
            "description": "Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation. By causing a sustained reporting or visibility loss, the adversary can effectively hide the present state of operations. This loss of view can occur without affecting the physical processes themselves. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "created": "2026-04-20T20:54:16.029Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1691/001",
                    "external_id": "T1691.001"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:49.021Z",
            "name": "Command Message",
            "description": "Adversaries may block a command message from reaching its intended target to prevent command execution. In OT networks, command messages are sent to provide instructions to control system devices. A blocked command message can inhibit response functions from correcting a disruption or unsafe condition.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)(Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0800",
                    "external_id": "T0800"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:54.157Z",
            "name": "Activate Firmware Update Mode",
            "description": "Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Joe Slowik - Dragos"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0831",
                    "external_id": "T0831"
                },
                {
                    "source_name": "Bruce Schneier January 2008",
                    "description": "Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ",
                    "url": "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html"
                },
                {
                    "source_name": "John Bill May 2017",
                    "description": "John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ",
                    "url": "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/"
                },
                {
                    "source_name": "Shelley Smith February 2008",
                    "description": "Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ",
                    "url": "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:10.752Z",
            "name": "Manipulation of Control",
            "description": "Adversaries may manipulate physical process control within the industrial environment. Methods of manipulating control can include changes to set point values, tags, or other parameters. Adversaries may manipulate control systems devices or possibly leverage their own, to communicate with and command physical control processes. The duration of manipulation may be temporary or longer sustained, depending on operator detection.   \n\nMethods of Manipulation of Control include: \n\n* Man-in-the-middle  \n* Spoof command message \n* Changing setpoints  \n\nA Polish student used a remote controller device to interface with the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) (Citation: Bruce Schneier January 2008) Using this remote, the student was able to capture and replay legitimate tram signals. As a consequence, four trams were derailed and twelve people injured due to resulting emergency stops. (Citation: Shelley Smith February 2008) The track controlling commands issued may have also resulted in tram collisions, a further risk to those on board and nearby the areas of impact. (Citation: Bruce Schneier January 2008)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0814",
                    "external_id": "T0814"
                },
                {
                    "source_name": "Common Weakness Enumeration January 2019",
                    "description": "Common Weakness Enumeration 2019, January 03 CWE-400: Uncontrolled Resource Consumption Retrieved. 2019/03/14 ",
                    "url": "http://cwe.mitre.org/data/definitions/400.html"
                },
                {
                    "source_name": "ICS-CERT April 2017",
                    "description": "ICS-CERT 2017, April 18 CS Alert (ICS-ALERT-17-102-01A) BrickerBot Permanent Denial-of-Service Attack Retrieved. 2019/10/24 ",
                    "url": "https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A"
                },
                {
                    "source_name": "ICS-CERT August 2018",
                    "description": "ICS-CERT 2018, August 27 Advisory (ICSA-15-202-01) - Siemens SIPROTEC Denial-of-Service Vulnerability Retrieved. 2019/03/14 ",
                    "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01"
                },
                {
                    "source_name": "MITRE March 2018",
                    "description": "MITRE 2018, March 22 CVE-2015-5374 Retrieved. 2019/03/14 ",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5374"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:33.649Z",
            "name": "Denial of Service",
            "description": "Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment. \n\nSome ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. (Citation: ICS-CERT April 2017) \n\nAdversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition. \n\nAdversaries may have prior knowledge about industrial protocols or control devices used in the environment through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888). There are examples of adversaries remotely causing a [Device Restart/Shutdown](https://attack.mitre.org/techniques/T0816) by exploiting a vulnerability that induces uncontrolled resource consumption. (Citation: ICS-CERT August 2018) (Citation: Common Weakness Enumeration January 2019) (Citation: MITRE March 2018) ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0805",
                    "external_id": "T0805"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:51.323Z",
            "name": "Block Serial COM",
            "description": "Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages. \n\nA serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10.0.0.1 via Telnet on serial port 1 with the following command: telnet 10.0.0.1 20001.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "created": "2024-03-25T20:16:15.016Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0894",
                    "external_id": "T0894"
                },
                {
                    "source_name": "GTFO split",
                    "description": "GTFOBins. (2020, November 13). split. Retrieved April 18, 2022.",
                    "url": "https://gtfobins.github.io/gtfobins/split/"
                },
                {
                    "source_name": "LOLBAS Project",
                    "description": "Oddvar Moe et al. (2022, February).  Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022.",
                    "url": "https://github.com/LOLBAS-Project/LOLBAS#criteria"
                },
                {
                    "source_name": "split man page",
                    "description": "Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022.",
                    "url": "https://man7.org/linux/man-pages/man1/split.1.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:51.235Z",
            "name": "System Binary Proxy Execution",
            "description": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. (Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands. (Citation: split man page)(Citation: GTFO split)\n\nAdversaries may abuse application binaries installed on a system for proxy execution of malicious code or domain-specific commands. These commands could be used to target local resources on the device or networked devices within the environment through defined APIs ([Execution through API](https://attack.mitre.org/techniques/T0871)) or application-specific programming languages (e.g., MicroSCADA SCIL). Application binaries may be signed by the developer or generally trusted by the operators, analysts, and monitoring tools accustomed to the environment. These applications may be developed and/or directly provided by the device vendor to enable configuration, management, and operation of their devices without many alternatives. \n\nAdversaries may seek to target these trusted application binaries to execute or send commands without the development of custom malware. For example, adversaries may target a SCADA server binary which has the existing ability to send commands to substation devices, such as through IEC 104 command messages. Proxy execution may still require the development of custom tools to hook into the application binary’s execution.\n\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--23270e54-1d68-4c3b-b763-b25607bcef80",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0850",
                    "external_id": "T0850"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:48:31.492Z",
            "name": "Role Identification",
            "description": "Adversaries may perform role identification of devices involved with physical processes of interest in a target control system. Control systems devices often work in concert to control a physical process. Each device can have one or more roles that it performs within that control process. By collecting this role-based data, an adversary can construct a more targeted attack.\n\nFor example, a power generation plant may have unique devices such as one that monitors power output of a generator and another that controls the speed of a turbine. Examining devices roles allows the adversary to observe how the two devices work together to monitor and control a physical process. Understanding the role of a target device can inform the adversary's decision on what action to take, in order to cause Impact and influence or disrupt the integrity of operations. Furthermore, an adversary may be able to capture control system protocol traffic. By studying this traffic, the adversary may be able to determine which devices are outstations, and which are masters. Understanding of master devices and their role within control processes can enable the use of Rogue Master Device",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Human-Machine Interface",
                "Control Server",
                "Data Historian",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0807",
                    "external_id": "T0807"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 Command-Line Interface Retrieved. 2018/05/17 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1059"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T16:50:33.026Z",
            "name": "Command-Line Interface",
            "description": "Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. (Citation: Enterprise ATT&CK January 2018) Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.\n\nCLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP.  Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0861",
                    "external_id": "T0861"
                },
                {
                    "source_name": "Dennis L. Sloatman September 2016",
                    "description": "Dennis L. Sloatman 2016, September 16 Understanding PLC Programming Methods and the Tag Database System Retrieved. 2017/12/19 ",
                    "url": "https://www.radioworld.com/industry/understanding-plc-programming-methods-and-the-tag-database-system"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:49.639Z",
            "name": "Point & Tag Identification",
            "description": "Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment. Points may be values such as inputs, memory locations, outputs or other process specific variables. (Citation: Dennis L. Sloatman September 2016) Tags are the identifiers given to points for operator convenience. \n\nCollecting such tags provides valuable context to environmental points and enables an adversary to map inputs, outputs, and other values to their control processes. Understanding the points being collected may inform an adversary on which processes and values to keep track of over the course of an operation.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Jos Wetzels - Midnight Blue"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0816",
                    "external_id": "T0816"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:53.838Z",
            "name": "Device Restart/Shutdown",
            "description": "Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands.\n\nUnexpected restart or shutdown of control system devices may prevent expected response functions happening during critical states.\n\nA device restart can also be a sign of malicious device modifications, as many updates require a shutdown in order to take effect.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0863",
                    "external_id": "T0863"
                },
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                },
                {
                    "source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
                    "description": "Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:50.591Z",
            "name": "User Execution",
            "description": "Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents. \n\nAdversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. (Citation: Booz Allen Hamilton) Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) \n\nA Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012 delivered malware through spearphishing attachments which required user action to achieve execution. (Citation: CISA AA21-201A Pipeline Intrusion July 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0860",
                    "external_id": "T0860"
                },
                {
                    "source_name": "Alexander Bolshev March 2014",
                    "description": "Alexander Bolshev 2014, March 11 S4x14: HART As An Attack Vector Retrieved November 17, 2024. ",
                    "url": "https://www.slideshare.net/slideshow/17-bolshev-1-13/32178888"
                },
                {
                    "source_name": "Alexander Bolshev, Gleb Cherbov July 2014",
                    "description": "Alexander Bolshev, Gleb Cherbov 2014, July 08 ICSCorsair: How I will PWN your ERP through 4-20 mA current loop Retrieved. 2020/01/05 ",
                    "url": "https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf"
                },
                {
                    "source_name": "Bruce Schneier January 2008",
                    "description": "Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ",
                    "url": "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html"
                },
                {
                    "source_name": "John Bill May 2017",
                    "description": "John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ",
                    "url": "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/"
                },
                {
                    "source_name": "Shelley Smith February 2008",
                    "description": "Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ",
                    "url": "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:34.560Z",
            "name": "Wireless Compromise",
            "description": "Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance. \n\nA Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. (Citation: Bruce Schneier January 2008) The controller then enabled initial access to the network, allowing the capture and replay of tram signals. (Citation: John Bill May 2017)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Scott Dougherty"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0858",
                    "external_id": "T0858"
                },
                {
                    "source_name": "Machine Information Systems 2007",
                    "description": "Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28 ",
                    "url": "http://www.machine-information-systems.com/How_PLCs_Work.html"
                },
                {
                    "source_name": "N.A. October 2017",
                    "description": "N.A. 2017, October What are the different operating modes in PLC? Retrieved. 2021/01/28 ",
                    "url": "https://forumautomation.com/t/what-are-the-different-operating-modes-in-plc/2489"
                },
                {
                    "source_name": "Omron",
                    "description": "Omron Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28  PLC Different Operating Modes Retrieved. 2021/01/28 ",
                    "url": "https://www.omron-ap.com/service_support/FAQ/FAQ00002/index.asp#:~:text=In%20PROGRAM%20mode%2C%20the%20CPU,can%20be%20created%20or%20modified."
                },
                {
                    "source_name": "PLCgurus 2021",
                    "description": "PLCgurus 2021 PLC Basics  Modes Of Operation Retrieved. 2021/01/28 ",
                    "url": "https://www.plcgurus.net/plc-basics/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:42.391Z",
            "name": "Change Operating Mode",
            "description": "Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download.   Programmable controllers typically have several modes of operation that control the state of the user program and control access to the controllers API. Operating modes can be physically selected using a key switch on the face of the controller but may also be selected with calls to the controllers API. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:  \n\n* Program - This mode must be enabled before changes can be made to a devices program. This allows program uploads and downloads between the device and an engineering workstation. Often the PLCs logic Is halted, and all outputs may be forced off. (Citation: N.A. October 2017)  \n* Run - Execution of the devices program occurs in this mode. Input and output (values, points, tags, elements, etc.) are monitored and used according to the programs logic. [Program Upload](https://attack.mitre.org/techniques/T0845) and [Program Download](https://attack.mitre.org/techniques/T0843) are disabled while in this mode. (Citation: Omron) (Citation: Machine Information Systems 2007)  (Citation: N.A. October 2017) (Citation: PLCgurus 2021)   \n* Remote - Allows for remote changes to a PLCs operation mode. (Citation: PLCgurus 2021)    \n* Stop - The PLC and program is stopped, while in this mode, outputs are forced off. (Citation: Machine Information Systems 2007)   \n* Reset - Conditions on the PLC are reset to their original states. Warm resets may retain some memory while cold resets will reset all I/O and data registers. (Citation: Machine Information Systems 2007)   \n* Test / Monitor mode - Similar to run mode, I/O is processed, although this mode allows for monitoring, force set, resets, and more generally tuning or debugging of the system. Often monitor mode may be used as a trial for initialization. (Citation: Omron)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0878",
                    "external_id": "T0878"
                },
                {
                    "source_name": "Jos Wetzels, Marina Krotofil 2019",
                    "description": "Jos Wetzels, Marina Krotofil 2019 A Diet of Poisoned Fruit: Designing Implants & OT Payloads for ICS Embedded Devices Retrieved. 2019/11/01 ",
                    "url": "https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:35.149Z",
            "name": "Alarm Suppression",
            "description": "Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole.\n\nA Secura presentation on targeting OT notes a dual fold goal for adversaries attempting alarm suppression: prevent outgoing alarms from being raised and prevent incoming alarms from being responded to. (Citation: Jos Wetzels, Marina Krotofil 2019) The method of suppression may greatly depend on the type of alarm in question:  \n\n* An alarm raised by a protocol message \n* An alarm signaled with I/O \n* An alarm bit set in a flag (and read) \n\nIn ICS environments, the adversary may have to suppress or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019)  Methods of suppression may involve tampering or altering device displays and logs, modifying in memory code to fixed values, or even tampering with assembly level instruction code.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Marina Krotofil",
                "Jos Wetzels - Midnight Blue"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0868",
                    "external_id": "T0868"
                },
                {
                    "source_name": "Machine Information Systems 2007",
                    "description": "Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28 ",
                    "url": "http://www.machine-information-systems.com/How_PLCs_Work.html"
                },
                {
                    "source_name": "N.A. October 2017",
                    "description": "N.A. 2017, October What are the different operating modes in PLC? Retrieved. 2021/01/28 ",
                    "url": "https://forumautomation.com/t/what-are-the-different-operating-modes-in-plc/2489"
                },
                {
                    "source_name": "Omron",
                    "description": "Omron Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28  PLC Different Operating Modes Retrieved. 2021/01/28 ",
                    "url": "https://www.omron-ap.com/service_support/FAQ/FAQ00002/index.asp#:~:text=In%20PROGRAM%20mode%2C%20the%20CPU,can%20be%20created%20or%20modified."
                },
                {
                    "source_name": "PLCgurus 2021",
                    "description": "PLCgurus 2021 PLC Basics  Modes Of Operation Retrieved. 2021/01/28 ",
                    "url": "https://www.plcgurus.net/plc-basics/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:45.236Z",
            "name": "Detect Operating Mode",
            "description": "Adversaries may gather information about a PLCs or controllers current operating mode. Operating modes dictate what change or maintenance functions can be manipulated and are often controlled by a key switch on the PLC (e.g.,  run, prog [program], and remote). Knowledge of these states may be valuable to an adversary to determine if they are able to reprogram the PLC. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:  \n\n* Program - This mode must be enabled before changes can be made to a devices program. This allows program uploads and downloads between the device and an engineering workstation. Often the PLCs logic Is halted, and all outputs may be forced off. (Citation: N.A. October 2017)  \n* Run - Execution of the devices program occurs in this mode. Input and output (values, points, tags, elements, etc.) are monitored and used according to the programs logic.[Program Upload](https://attack.mitre.org/techniques/T0845) and [Program Download](https://attack.mitre.org/techniques/T0843) are disabled while in this mode. (Citation: Omron) (Citation: Machine Information Systems 2007)  (Citation: N.A. October 2017) (Citation: PLCgurus 2021)   \n* Remote - Allows for remote changes to a PLCs operation mode. (Citation: PLCgurus 2021)    \n* Stop - The PLC and program is stopped, while in this mode, outputs are forced off. (Citation: Machine Information Systems 2007)   \n* Reset - Conditions on the PLC are reset to their original states. Warm resets may retain some memory while cold resets will reset all I/O and data registers. (Citation: Machine Information Systems 2007)   \n* Test / Monitor mode - Similar to run mode, I/O is processed, although this mode allows for monitoring, force set, resets, and more generally tuning or debugging of the system. Often monitor mode may be used as a trial for initialization. (Citation: Omron)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163",
            "created": "2021-04-12T07:57:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0837",
                    "external_id": "T0837"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:12.172Z",
            "name": "Loss of Protection",
            "description": "Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions. This can result in equipment damage, prolonged process disruptions and hazards to personnel. \n\nMany faults and abnormal conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage. \n\nAdversaries may target and disable protective system functions as a prerequisite to subsequent attack execution or to allow for future faults and abnormal conditions to go unchecked. Detection of a Loss of Protection by operators can result in the shutdown of a process due to strict policies regarding protection systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0801",
                    "external_id": "T0801"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:34.856Z",
            "name": "Monitor Process State",
            "description": "Adversaries may gather information about the physical process state. This information may be used to gain more information about the process itself or used as a trigger for malicious actions. The sources of process state information may vary such as, OPC tags, historian data, specific PLC block information, or network traffic.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0853",
                    "external_id": "T0853"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T16:51:17.493Z",
            "name": "Scripting",
            "description": "Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions. \n\nIn addition to being a useful tool for developers and administrators, scripting language interpreters may be abused by the adversary to execute code in the target environment. Due to the nature of scripting languages, this allows for weaponized code to be deployed to a target easily, and leaves open the possibility of on-the-fly scripting to perform a task.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "created": "2021-04-13T12:45:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0888",
                    "external_id": "T0888"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:49.322Z",
            "name": "Remote System Information Discovery",
            "description": "An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration. Adversaries may use information from Remote System Information Discovery to aid in targeting and shaping follow-on behaviors. For example, the system's operational role and model information can dictate whether it is a relevant target for the adversary's operational objectives. In addition, the system's configuration may be used to scope subsequent technique usage. \n\nRequests for system information are typically implemented using automation and management protocols and are often automatically requested by vendor software during normal operation. This information may be used to tailor management actions, such as program download and system or module firmware. An adversary may leverage this same information by issuing calls directly to the system's API.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0845",
                    "external_id": "T0845"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:43.645Z",
            "name": "Program Upload",
            "description": "Adversaries may attempt to upload a program from a PLC to gather information about an industrial process. Uploading a program may allow them to acquire and study the underlying logic. Methods of program upload include vendor software, which enables the user to upload and read a program running on a PLC. This software can be used to upload the target program to a workstation, jump box, or an interfacing device.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0819",
                    "external_id": "T0819"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:37.841Z",
            "name": "Exploit Public-Facing Application",
            "description": "Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network. Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility.\n\nAn adversary may seek to target public-facing applications as they may provide direct access into an ICS environment or the ability to move into the ICS network. Publicly exposed applications may be found through online tools that scan the internet for open ports and services. Version numbers for the exposed application may provide adversaries an ability to target specific known vulnerabilities. Exposed control protocol or remote access ports found in Commonly Used Port may be of interest by adversaries.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "created": "2026-04-20T20:50:34.107Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1691",
                    "external_id": "T1691"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:55.761Z",
            "name": "Block Operational Technology Message",
            "description": "Adversaries may block messages between systems and devices in an OT/ICS environment to disrupt processes. Messages typically fall into two categories: (1) reporting messages that contain telemetry data about the current state of systems, devices, and processes and (2) command messages that contain instructions to control systems, devices, and processes. Both types of messages are critical for the proper functioning of industrial control processes and failure of the messages to reach their intended destinations could inhibit response functions or create an unsafe condition that could have physical impacts.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)(Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)\n\nAdversaries may block communications by either making modifications to software ([System Firmware](https://attack.mitre.org/techniques/T0857), [Module Firmware](https://attack.mitre.org/techniques/T0839), [Hooking](https://attack.mitre.org/techniques/T0874), and [Rootkit](https://attack.mitre.org/techniques/T0851)) and services ([Service Stop](https://attack.mitre.org/techniques/T0881), [Denial of Service](https://attack.mitre.org/techniques/T0814)) on systems and devices or by positioning themselves between systems and devices and intercepting and blocking the communications such as the case with an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0811",
                    "external_id": "T0811"
                },
                {
                    "source_name": "Cybersecurity & Infrastructure Security Agency March 2018",
                    "description": "Cybersecurity & Infrastructure Security Agency 2018, March 15 Alert (TA18-074A) Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors Retrieved. 2019/10/11 ",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA18-074A"
                },
                {
                    "source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
                    "description": "Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:42.082Z",
            "name": "Data from Information Repositories",
            "description": "Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of information repositories include reference databases in the process environment, as well as databases in the corporate network that might contain information about the ICS.(Citation: Cybersecurity & Infrastructure Security Agency March 2018)\n\nInformation collected from these systems may provide the adversary with a better understanding of the operational environment, vendors used, processes, or procedures of the ICS.\n\nIn a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD*, user credentials, and remote dial-up access information. (Citation: CISA AA21-201A Pipeline Intrusion July 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "created": "2021-10-14T15:25:32.143Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0864",
                    "external_id": "T0864"
                },
                {
                    "source_name": "North American Electric Reliability Corporation June 2021",
                    "description": "North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 ",
                    "url": "https://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:39.050Z",
            "name": "Transient Cyber Asset",
            "description": "Adversaries may target devices that are transient across ICS networks and external networks. Normally, transient assets are brought into an environment by authorized personnel and do not remain in that environment on a permanent basis. (Citation: North American Electric Reliability Corporation June 2021) Transient assets are commonly needed to support management functions and may be more common in systems where a remotely managed asset is not feasible, external connections for remote access do not exist, or 3rd party contractor/vendor access is required. \n\nAdversaries may take advantage of transient assets in different ways. For instance, adversaries may target a transient asset when it is connected to an external network and then leverage its trusted access in another environment to launch an attack. They may also take advantage of installed applications and libraries that are used by legitimate end-users to interact with control system devices. \n\nTransient assets, in some cases, may not be deployed with a secure configuration leading to weaknesses that could allow an adversary to propagate malicious executable code, e.g., the transient asset may be infected by malware and when connected to an ICS environment the malware propagates onto other systems. ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "created": "2026-04-20T20:54:20.103Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0873/001",
                    "external_id": "T0873.001"
                },
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:56.775Z",
            "name": "Siemens Project File Format",
            "description": "Adversaries may infect Siemens PLC project files (i.e., Step 7, WinCC, etc.) to achieve [Execution](https://attack.mitre.org/tactics/TA0104), [Persistence](https://attack.mitre.org/tactics/TA0110), and [Lateral Movement](https://attack.mitre.org/tactics/TA0109) objectives. Adversaries may modify an existing project file or bring their own project files into the environment.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)\n\nThe ability for an adversary to deploy an infected project file relies on access to a workstation with Siemens PLC programming software installed on it from which a program download can be performed.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0835",
                    "external_id": "T0835"
                },
                {
                    "source_name": "Dr. Kelvin T. Erickson December 2010",
                    "description": "Dr. Kelvin T. Erickson 2010, December Programmable logic controller hardware Retrieved November 17, 2024.",
                    "url": "https://www.scribd.com/document/458637574/Programmable-Logic-Controllers"
                },
                {
                    "source_name": "Nanjundaiah, Vaidyanath",
                    "description": "Nanjundaiah, Vaidyanath Dr. Kelvin T. Erickson 2010, December Programmable logic controller hardware Retrieved. 2018/03/29  PLC Ladder Logic Basics Retrieved. 2021/10/11 ",
                    "url": "https://www.ezautomation.net/industry-articles/plc-ladder-logic-basics.htm"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:46.553Z",
            "name": "Manipulate I/O Image",
            "description": "Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. (Citation: Dr. Kelvin T. Erickson December 2010) During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules. \n\nOne of the unique characteristics of PLCs is their ability to override the status of a physical discrete input or to override the logic driving a physical output coil and force the output to a desired status.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0842",
                    "external_id": "T0842"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 Network Sniffing Retrieved. 2018/05/17 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1040"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:53.525Z",
            "name": "Network Sniffing",
            "description": "Network sniffing is the practice of using a network interface on a computer system to monitor or capture information (Citation: Enterprise ATT&CK January 2018) regardless of whether it is the specified destination for the information. \n\nAn adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines.  Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as Telnet, that can be captured and obtained through network packet analysis. \n\nIn addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0851",
                    "external_id": "T0851"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 Rootkit Retrieved. 2018/05/16 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1014"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:47.792Z",
            "name": "Rootkit",
            "description": "Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. (Citation: Enterprise ATT&CK January 2018)   \n\nFirmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for the I/O that is attached to an asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable [Impact](https://attack.mitre.org/tactics/TA0105).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0802",
                    "external_id": "T0802"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:36.361Z",
            "name": "Automated Collection",
            "description": "Adversaries may automate collection of industrial environment information using tools or scripts. This automated collection may leverage native control protocols and tools available in the control systems environment. For example, the OPC protocol may be used to enumerate and gather information. Access to a system or interface with these native protocols may allow collection and enumeration of other attached, communicating servers and devices.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "created": "2026-04-20T20:50:35.222Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1694",
                    "external_id": "T1694"
                },
                {
                    "source_name": "ICS-ALERT-13-164-01",
                    "description": "Cybersecurity and Infrastructure Security Agency (CISA). (2013, October 29). Medical Devices Hard-Coded Passwords. Retrieved April 23, 2026.",
                    "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01"
                },
                {
                    "source_name": "OT IceFall",
                    "description": "Forescout Vedere Labs. (2022, June). OT: IceFall Report. Retrieved April 23, 2026.",
                    "url": "https://www.forescout.com/resources/ot-icefall-report/"
                },
                {
                    "source_name": "NIST SP 800-82r3",
                    "description": "Keith Stouffer. (2023, September). Guide to Operational Technology  (OT) Security. Retrieved April 22, 2026.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:56.454Z",
            "name": "Insecure Credentials",
            "description": "Adversaries may target insecure credentials as a means to persist on a system or device or move laterally from one system or device to another. Insecure credentials may appear as default credentials which are pre-configured credentials on a system, device, or software that are well-known in documentation or hard-coded credentials which are built into the system, device, or software that cannot be changed or not easily changed because of the impact on control processes.(Citation: NIST SP 800-82r3)(Citation: ICS-ALERT-13-164-01)(Citation: OT IceFall)\n Adversaries often times use insecure credentials to evade detection as they are typically forgotten about by system and device owners.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0804",
                    "external_id": "T0804"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:39.117Z",
            "name": "Block Reporting Message",
            "description": "Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator.\n\nBlocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)  (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0855",
                    "external_id": "T0855"
                },
                {
                    "source_name": "Benjamin Freed March 2019",
                    "description": "Benjamin Freed 2019, March 13 Tornado sirens in Dallas suburbs deactivated after being hacked and set off Retrieved. 2020/11/06 ",
                    "url": "https://statescoop.com/tornado-sirens-in-dallas-suburbs-deactivated-after-being-hacked-and-set-off/"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Zack Whittaker April 2017",
                    "description": "Zack Whittaker 2017, April 12 Dallas' emergency sirens were hacked with a rogue radio signal Retrieved. 2020/11/06 ",
                    "url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:41.104Z",
            "name": "Unauthorized Command Message",
            "description": "Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\n\nIn the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster. (Citation: Zack Whittaker April 2017) (Citation: Benjamin Freed March 2019)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "created": "2026-04-20T20:54:17.053Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1692/001",
                    "external_id": "T1692.001"
                },
                {
                    "source_name": "Benjamin Freed March 2019",
                    "description": "Benjamin Freed 2019, March 13 Tornado sirens in Dallas suburbs deactivated after being hacked and set off Retrieved. 2020/11/06 ",
                    "url": "https://statescoop.com/tornado-sirens-in-dallas-suburbs-deactivated-after-being-hacked-and-set-off/"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Zack Whittaker April 2017",
                    "description": "Zack Whittaker 2017, April 12 Dallas' emergency sirens were hacked with a rogue radio signal Retrieved. 2020/11/06 ",
                    "url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:51.581Z",
            "name": "Command Message",
            "description": "Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011). An adversary could also misuse control system devices to store data collected from the network for later use.\n\nIn the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "2.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0809",
                    "external_id": "T0809"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 File Deletion Retrieved. 2018/05/17 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1107"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:43.027Z",
            "name": "Data Destruction",
            "description": "Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process. (Citation: Enterprise ATT&CK January 2018)\n\nData destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident.\n\nStandard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Matan Dobrushin - Otorio"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0832",
                    "external_id": "T0832"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-15T19:58:29.210Z",
            "name": "Manipulation of View",
            "description": "Adversaries may attempt to manipulate the information reported back to operators or controllers. This manipulation may be short term or sustained. During this time the process itself could be in a much different state than what is reported. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) \n\nOperators may be fooled into doing something that is harmful to the system in a loss of view situation. With a manipulated view into the systems, operators may issue inappropriate control sequences that introduce faults or catastrophic failures into the system. Business analysis systems can also be provided with inaccurate data leading to bad management decisions.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0810",
                    "external_id": "T0810"
                },
                {
                    "source_name": "Industroyer - Dragos - 201810",
                    "description": "Dragos. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved October 14, 2019.",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:48:46.334Z",
            "name": "Data Historian Compromise",
            "description": "Adversaries may compromise and gain control of a data historian to gain a foothold into the control system environment. Access to a data historian may be used to learn stored database archival and analysis information on the control system. A dual-homed data historian may provide adversaries an interface from the IT environment to the OT environment. \n\nDragos has released an updated analysis on CrashOverride that outlines the attack from the ICS network breach to payload delivery and execution.  (Citation: Industroyer - Dragos - 201810) The report summarized that CrashOverride represents a new application of malware, but relied on standard intrusion techniques. In particular, new artifacts include references to a Microsoft Windows Server 2003 host, with a SQL Server. Within the ICS environment, such a database server can act as a data historian. Dragos noted a device with this role should be \"expected to have extensive connections\" within the ICS environment. Adversary activity leveraged database capabilities to perform reconnaissance, including directory queries and network connectivity checks.\n\nPermissions Required: Administrator\n\nContributors: Joe Slowik - Dragos",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Joe Slowik - Dragos"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "created": "2026-04-20T20:54:17.539Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1692/002",
                    "external_id": "T1692.002"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:39.649Z",
            "name": "Reporting Message",
            "description": "Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values.\n\nIf an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--539d0484-fe95-485a-b654-86991c0d0d00",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0841",
                    "external_id": "T0841"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:48:47.931Z",
            "name": "Network Service Scanning",
            "description": "Network Service Scanning is the process of discovering services on networked systems.  This can be achieved through a technique called port scanning or probing.  Port scanning interacts with the TCP/IP ports on a target system to determine whether ports are open, closed, or filtered by a firewall.  This does not reveal the service that is running behind the port, but since many common services are run on [https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml specific port numbers], the type of service can be assumed.  More in-depth testing includes interaction with the actual service to determine the service type and specific version.  One of the most-popular tools to use for Network Service Scanning is [https://nmap.org/ Nmap].\n\nAn adversary may attempt to gain information about a target device and its role on the network via Network Service Scanning techniques, such as port scanning.  Network Service Scanning is useful for determining potential vulnerabilities in services on target devices.  Network Service Scanning is closely tied to .\n\nScanning ports can be noisy on a network. In some attacks, adversaries probe for specific ports using custom tools. This was specifically seen in the Triton and PLC-Blaster attacks.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0872",
                    "external_id": "T0872"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:40.569Z",
            "name": "Indicator Removal on Host",
            "description": "Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0877",
                    "external_id": "T0877"
                },
                {
                    "source_name": "Nanjundaiah, Vaidyanath",
                    "description": "Nanjundaiah, Vaidyanath   PLC Ladder Logic Basics Retrieved. 2021/10/11 ",
                    "url": "https://www.ezautomation.net/industry-articles/plc-ladder-logic-basics.htm"
                },
                {
                    "source_name": "Spenneberg, Ralf 2016",
                    "description": "Spenneberg, Ralf 2016 PLC-Blaster Retrieved. 2019/06/06 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:46.862Z",
            "name": "I/O Image",
            "description": "Adversaries may seek to capture process values related to the inputs and outputs of a PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.\n\nThe Input and Output Image tables described above make up the I/O Image on a PLC. This image is used by the user program instead of directly interacting with physical I/O. (Citation: Spenneberg, Ralf 2016) \n\nAdversaries may collect the I/O Image state of a PLC by utilizing a devices [Native API](https://attack.mitre.org/techniques/T0834) to access the memory regions directly. The collection of the PLCs I/O state could be used to replace values or inform future stages of an attack.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "created": "2026-04-20T20:54:22.399Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1695/001",
                    "external_id": "T1695.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:52.564Z",
            "name": "Serial COM",
            "description": "Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages.\n\nA serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10.0.0.1 via Telnet on serial port 1 with the following command: telnet 10.0.0.1 20001.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "created": "2026-04-20T20:54:19.020Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1694/001",
                    "external_id": "T1694.001"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:42.708Z",
            "name": "Default Credentials",
            "description": "Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed.(Citation: Keith Stouffer May 2015)\n\nDefault credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0815",
                    "external_id": "T0815"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-15T19:58:33.142Z",
            "name": "Denial of View",
            "description": "Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment. This may manifest itself as a temporary communication failure between a device and its control source, where the interface recovers and becomes available once the interference ceases. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) \n\nAn adversary may attempt to deny operator visibility by preventing them from receiving status and reporting messages. Denying this view may temporarily block and prevent operators from noticing a change in state or anomalous behavior. The environment's data and processes may still be operational, but functioning in an unintended or adversarial manner. ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "created": "2026-04-20T20:54:25.997Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0843/003",
                    "external_id": "T0843.003"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:59.405Z",
            "name": "Program Append",
            "description": "Adversaries may execute a program append to a PLC to update parts of an existing program. It may or may not require stopping the PLC which may allow it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection. \n\nThe ability to perform a program append to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0871",
                    "external_id": "T0871"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:38.469Z",
            "name": "Execution through API",
            "description": "Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware. Specific functionality is often coded into APIs which can be called by software to engage specific functions on a device or other software.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "created": "2026-04-20T20:54:20.714Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0846/001",
                    "external_id": "T0846.001"
                },
                {
                    "source_name": "NIST SP 800-82r3",
                    "description": "Keith Stouffer. (2023, September). Guide to Operational Technology  (OT) Security. Retrieved April 22, 2026.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:57.097Z",
            "name": "Port Scan",
            "description": "Adversaries may perform a port scan on a system, device, or network to identify live hosts, enumerate open ports and running services, identify operating systems, and map out the network.(Citation: NIST SP 800-82r3) The results of a port scan may inform adversary [Discovery](https://attack.mitre.org/tactics/TA0102), [Lateral Movement](https://attack.mitre.org/tactics/TA0109), and vulnerability exploitation decisions ([Exploitation for Evasion](https://attack.mitre.org/techniques/T0820), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T0890), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T0866)). \n\nSome common tools for executing a port scan include `nmap`, `netcat`, and the Advanced Port Scanner.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0862",
                    "external_id": "T0862"
                },
                {
                    "source_name": "Control Global May 2019",
                    "description": "Control Global 2019, May 29 Yokogawa announcement warns of counterfeit transmitters Retrieved. 2021/04/09 ",
                    "url": "https://www.controlglobal.com/industrynews/2019/yokogawa-announcement-warns-of-counterfeit-transmitters/"
                },
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:35.442Z",
            "name": "Supply Chain Compromise",
            "description": "Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment. \n\nSupply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.   \n\nCounterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. (Citation: Control Global May 2019) \n\nYokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. (Citation: Control Global May 2019) \n\nF-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5f3da2f3-91c8-4d8b-a02f-bf43a11def55",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0854",
                    "external_id": "T0854"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:48:50.649Z",
            "name": "Serial Connection Enumeration",
            "description": "Adversaries may perform serial connection enumeration to gather situational awareness after gaining access to devices in the OT network. Control systems devices often communicate to each other via various types of serial communication mediums. These serial communications are used to facilitate informational communication, as well as commands.  Serial Connection Enumeration differs from I/O Module Discovery, as I/O modules are auxiliary systems to the main system, and devices that are connected via serial connection are normally discrete systems.\n\nWhile IT and OT networks may work in tandem, the exact structure of the OT network may not be discernible from the IT network alone. After gaining access to a device on the OT network, an adversary may be able to enumerate the serial connections. From this perspective, the adversary can see the specific physical devices to which the compromised device is connected to. This gives the adversary greater situational awareness and can influence the actions that the adversary can take in an attack.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Input/Output Server",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0880",
                    "external_id": "T0880"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:14.990Z",
            "name": "Loss of Safety",
            "description": "Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur. Safety systems are often composed of the same elements as control systems but have the sole purpose of ensuring the process fails in a predetermined safe manner. \n\nMany unsafe conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage. \n\nAdversaries may target and disable safety system functions as a prerequisite to subsequent attack execution or to allow for future unsafe conditionals to go unchecked. Detection of a Loss of Safety by operators can result in the shutdown of a process due to strict policies regarding safety systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "created": "2026-04-20T20:54:22.891Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1695/002",
                    "external_id": "T1695.002"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:58.412Z",
            "name": "Ethernet",
            "description": "Adversaries may block access to Ethernet communications to prevent instructions or configurations messages from reaching target systems and devices. Ethernet connections allow for communications between IT and OT systems and devices. Blocking Ethernet communications may also block command and reporting messages.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\n\nAn adversary may block Ethernet communications by disabling network interfaces, [Service Stop](https://attack.mitre.org/techniques/T0881), or conducting an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack and dropping the network traffic.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0828",
                    "external_id": "T0828"
                },
                {
                    "source_name": "Colonial Pipeline Company May 2021",
                    "description": "Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 ",
                    "url": "https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption"
                },
                {
                    "source_name": "Lion Corporation June 2020",
                    "description": "Lion Corporation 2020, June 26 Lion Cyber incident update: 26 June 2020 Retrieved. 2021/10/08 ",
                    "url": "https://lionco.com/2020/06/26/lion-update-re-cyber-issue/"
                },
                {
                    "source_name": "Paganini, Pierluigi June 2020",
                    "description": "Paganini, Pierluigi 2020, June 14 Ransomware attack disrupts operations at Australian beverage company Lion Retrieved. 2021/10/08 ",
                    "url": "https://securityaffairs.co/wordpress/104749/cyber-crime/ransomware-attack-hit-lion.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:15.157Z",
            "name": "Loss of Productivity and Revenue",
            "description": "Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments. \n\nIn cases where these operations or services are brought to a halt, the loss of productivity may eventually present an impact for the end-users or consumers of products and services. The disrupted supply-chain may result in supply shortages and increased prices, among other consequences. \n\nA ransomware attack on an Australian beverage company resulted in the shutdown of some manufacturing sites, including precautionary halts to protect key systems. (Citation: Paganini, Pierluigi June 2020) The company announced the potential for temporary shortages of their products following the attack. (Citation: Paganini, Pierluigi June 2020) (Citation: Lion Corporation June 2020) \n\nIn the 2021 Colonial Pipeline ransomware incident, the pipeline was unable to transport approximately 2.5 million barrels of fuel per day to the East Coast.  (Citation: Colonial Pipeline Company May 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0865",
                    "external_id": "T0865"
                },
                {
                    "source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
                    "description": "Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
                },
                {
                    "source_name": "Enterprise ATT&CK October 2019",
                    "description": "Enterprise ATT&CK 2019, October 25 Spearphishing Attachment Retrieved. 2019/10/25 ",
                    "url": "https://attack.mitre.org/techniques/T1193/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:48.102Z",
            "name": "Spearphishing Attachment",
            "description": "Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T0863) to gain execution and access. (Citation: Enterprise ATT&CK October 2019) \n\nA Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012, targeted ONG organizations and their employees. The emails were constructed with a high level of sophistication to convince employees to open the malicious file attachments. (Citation: CISA AA21-201A Pipeline Intrusion July 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "created": "2026-04-20T20:54:21.726Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0846/003",
                    "external_id": "T0846.003"
                },
                {
                    "source_name": "Cisco Active Discovery",
                    "description": "Cisco Systems, Inc.. (2024, March 5). Cisco Cyber Vision Active Discovery Configuration Guide, Release 4.3.0. Retrieved April 23, 2026.",
                    "url": "https://www.cisco.com/c/en/us/td/docs/security/cyber_vision/publications/Active-Discovery/Release-4-3-0/b_Cisco_Cyber_Vision_Active_Discovery_Configuration_Guide.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:57.756Z",
            "name": "Multicast Discovery",
            "description": "Adversaries may perform multicast discovery requests which is when one system or device sends messages to all systems and devices in a pre-defined group on a network (or subnet) and then waits for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol.  Multicast discovery tends to be stealthier than broadcast discovery because every system or device on the network (or subnet) is not being messaged. \n\nOne common OT protocol that has a multicast discovery mechanism is the Process Field Network (PROFINET) Discovery and Configuration Protocol (DCP) with its Identify All requests.(Citation: Cisco Active Discovery)\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "created": "2026-04-20T20:54:18.031Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1693/001",
                    "external_id": "T1693.001"
                },
                {
                    "source_name": "Basnight, Zachry, et al.",
                    "description": "Basnight, Zachry, et al. 2013 Retrieved. 2017/10/17 ",
                    "url": "http://www.sciencedirect.com/science/article/pii/S1874548213000231"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:35.752Z",
            "name": "System Firmware",
            "description": "System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network.\n\nAn adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers.(Citation: Basnight, Zachry, et al.)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "created": "2026-04-20T20:54:19.528Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1694/002",
                    "external_id": "T1694.002"
                },
                {
                    "source_name": "ICS-ALERT-13-164-01",
                    "description": "Cybersecurity and Infrastructure Security Agency (CISA). (2013, October 29). Medical Devices Hard-Coded Passwords. Retrieved April 23, 2026.",
                    "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01"
                },
                {
                    "source_name": "OT IceFall",
                    "description": "Forescout Vedere Labs. (2022, June). OT: IceFall Report. Retrieved April 23, 2026.",
                    "url": "https://www.forescout.com/resources/ot-icefall-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:52.885Z",
            "name": "Hardcoded Credentials",
            "description": "Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset. Examples credentials that may be hardcoded in an asset include:\n\n* Username/Passwords\n* Cryptographic keys/Certificates\n* API tokens\n\nUnlike [Default Credentials](https://attack.mitre.org/techniques/T0812), these credentials are built into the system in a way that they either cannot be changed by the asset owner, or may be infeasible to change because of the impact it would cause to the control system operation. These credentials may be reused across whole product lines or device models and are often not published or known to the owner and operators of the asset.(Citation: ICS-ALERT-13-164-01)(Citation: OT IceFall)\n\nAdversaries may utilize these hardcoded credentials to move throughout the control system environment or provide reliable access for their tools to interact with industrial assets.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "created": "2026-04-20T20:54:23.383Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1695/003",
                    "external_id": "T1695.003"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:58.743Z",
            "name": "Wi-Fi",
            "description": "Adversaries may block access to Wi-Fi communications to prevent messages from reaching target systems and devices. Wi-Fi connections allow for communications between IT and OT systems and devices. Blocking Wi-Fi communications may also block command and reporting messages.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\n\nAn adversary may block Wi-Fi communications by disabling network interfaces, [Service Stop](https://attack.mitre.org/techniques/T0881), conducting an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack and dropping the network traffic, or by jamming the Wi-Fi signal.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--7374ab87-0782-41f8-b415-678c0950bb2a",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0825",
                    "external_id": "T0825"
                },
                {
                    "source_name": "Guidance - NIST SP800-82",
                    "description": "Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:48:57.419Z",
            "name": "Location Identification",
            "description": "Adversaries may perform location identification using device data to inform operations and targeted impact for attacks. Location identification data can come in a number of forms, including geographic location, location relative to other control system devices, time zone, and current time. An adversary may use an embedded global positioning system (GPS) module in a device to figure out the physical coordinates of a device. NIST SP800-82 recommends that devices utilize GPS or another location determining mechanism to attach appropriate timestamps to log entries (Citation: Guidance - NIST SP800-82). While this assists in logging and event tracking, an adversary could use the underlying positioning mechanism to determine the general location of a device. An adversary can also infer the physical location of serially connected devices by using serial connection enumeration. \n\nAn adversary attempt to attack and cause Impact could potentially affect other control system devices in close proximity. Device local-time and time-zone settings can also provide adversaries a rough indicator of device location, when specific geographic identifiers cannot be determined from the system.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Control Server"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "created": "2026-04-20T20:54:18.535Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1693/002",
                    "external_id": "T1693.002"
                },
                {
                    "source_name": "Daniel Peck,  Dale Peterson January 2009",
                    "description": "Daniel Peck,  Dale Peterson 2009, January 28 Leveraging Ethernet Card Vulnerabilities in Field Devices Retrieved. 2017/12/19 ",
                    "url": "https://www.researchgate.net/publication/228849043_Leveraging_ethernet_card_vulnerabilities_in_field_devices"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:50.273Z",
            "name": "Module Firmware",
            "description": "Adversaries may install malicious or vulnerable firmware onto modular hardware devices. Control system devices often contain modular hardware devices. These devices may have their own set of firmware that is separate from the firmware of the main control system equipment.\n\nThis technique is similar to System Firmware, but is conducted on other system components that may not have the same capabilities or level of integrity checking. Although it results in a device re-image, malicious device firmware may provide persistent access to remaining devices.(Citation: Daniel Peck,  Dale Peterson January 2009)\n\nAn easy point of access for an adversary is the Ethernet card, which may have its own CPU, RAM, and operating system. The adversary may attack and likely exploit the computer on an Ethernet card. Exploitation of the Ethernet card computer may enable the adversary to accomplish additional attacks, such as the following:(Citation: Daniel Peck,  Dale Peterson January 2009)\n\n* Delayed Attack - The adversary may stage an attack in advance and choose when to launch it, such as at a particularly damaging time.\n* Brick the Ethernet Card - Malicious firmware may be programmed to result in an Ethernet card failure, requiring a factory return.\n* Random Attack or Failure - The adversary may load malicious firmware onto multiple field devices. Execution of an attack and the time it occurs is generated by a pseudo-random number generator.\n* A Field Device Worm - The adversary may choose to identify all field devices of the same model, with the end goal of performing a device-wide compromise.\n* Attack Other Cards on the Field Device - Although it is not the most important module in a field device, the Ethernet card is most accessible to the adversary and malware. Compromise of the Ethernet card may provide a more direct route to compromising other modules, such as the CPU module.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "created": "2026-04-20T20:54:23.982Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0843/001",
                    "external_id": "T0843.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:59.072Z",
            "name": "Download All",
            "description": "Adversaries may execute a full program download to a PLC to overwrite the entire PLC program and configuration to deploy a new project or make major changes. This typically requires stopping the PLC and adversely impacting control processes.\n\nThe ability to perform a full program download to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "created": "2024-03-26T15:39:19.473Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0895",
                    "external_id": "T0895"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:39.943Z",
            "name": "Autorun Image",
            "description": "Adversaries may leverage AutoRun functionality or scripts to execute malicious code. Devices configured to enable AutoRun functionality or legacy operating systems may be susceptible to abuse of these features to run malicious code stored on various forms of removeable media (i.e., USB, Disk Images [.ISO]). Commonly, AutoRun or AutoPlay are disabled in many operating systems configurations to mitigate against this technique. If a device is configured to enable AutoRun or AutoPlay, adversaries may execute code on the device by mounting the removable media to the device, either through physical or virtual means. This may be especially relevant for virtual machine environments where disk images may be dynamically mapped to a guest system on a hypervisor.  \n\nAn example could include an adversary gaining access to a hypervisor through the management interface to modify a virtual machine’s hardware configuration. They could then deploy an iso image with a malicious AutoRun script to cause the virtual machine to automatically execute the code contained on the disk image. This would enable the execution of malicious code within a virtual machine without needing any prior remote access to that system.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0817",
                    "external_id": "T0817"
                },
                {
                    "source_name": "Cybersecurity & Infrastructure Security Agency March 2018",
                    "description": "Cybersecurity & Infrastructure Security Agency 2018, March 15 Alert (TA18-074A) Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors Retrieved. 2019/10/11 ",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA18-074A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:48.399Z",
            "name": "Drive-by Compromise",
            "description": "Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session. With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website. \n\nThe adversary may target a specific community, such as trusted third party suppliers or other industry specific groups, which often visit the target website. This kind of targeted attack relies on a common interest, and is known as a strategic web compromise or watering hole attack. \n\nThe National Cyber Awareness System (NCAS) has issued a Technical Alert (TA) regarding Russian government cyber activity targeting critical infrastructure sectors. (Citation: Cybersecurity & Infrastructure Security Agency March 2018) Analysis by DHS and FBI has noted two distinct categories of victims in the Dragonfly campaign on the Western energy sector: staging and intended targets. The adversary targeted the less secure networks of staging targets, including trusted third-party suppliers and related peripheral organizations. Initial access to the intended targets used watering hole attacks to target process control, ICS, and critical infrastructure related trade publications and informational websites.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "created": "2026-04-20T20:54:16.584Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1691/002",
                    "external_id": "T1691.002"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:49.952Z",
            "name": "Reporting Message",
            "description": "Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator.\n\nBlocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)(Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "created": "2026-04-20T20:50:34.850Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1693",
                    "external_id": "T1693"
                },
                {
                    "source_name": "Basnight, Zachry, et al.",
                    "description": "Basnight, Zachry, et al. 2013 Retrieved. 2017/10/17 ",
                    "url": "http://www.sciencedirect.com/science/article/pii/S1874548213000231"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:56.116Z",
            "name": "Modify Firmware",
            "description": "Firmware is low-level software embedded in hardware that enables systems and devices to function properly and is commonly found in ICS environments. Adversaries may modify firmware on a system or device by installing malicious or vulnerable versions that enable them to achieve objectives such as [Persistence](https://attack.mitre.org/tactics/TA0110), [Impair Process Control](https://attack.mitre.org/tactics/TA0106), and [Inhibit Response Function](https://attack.mitre.org/tactics/TA0107). \n\nAdversaries may modify system and device firmware by using the built-in firmware update functionality which may support local or remote installation. The malicious or vulnerable firmware may be delivered via [Replication Through Removable Media](https://attack.mitre.org/techniques/T0847), [Supply Chain Compromise](https://attack.mitre.org/techniques/T0862), or [Remote Services](https://attack.mitre.org/techniques/T0886). Once installed, the malicious or vulnerable firmware could be used to provide [Rootkit](https://attack.mitre.org/techniques/T0851) and [Hooking](https://attack.mitre.org/techniques/T0874) functionality, [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T0890), or [Denial of Service](https://attack.mitre.org/techniques/T0814).(Citation: Basnight, Zachry, et al.)\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0879",
                    "external_id": "T0879"
                },
                {
                    "source_name": "Bruce Schneier January 2008",
                    "description": "Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ",
                    "url": "https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html"
                },
                {
                    "source_name": "BSI State of IT Security 2014",
                    "description": "Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 ",
                    "url": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3"
                },
                {
                    "source_name": "John Bill May 2017",
                    "description": "John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ",
                    "url": "https://www.londonreconnections.com/2017/hacked-cyber-security-railways/"
                },
                {
                    "source_name": "Shelley Smith February 2008",
                    "description": "Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ",
                    "url": "https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:15.731Z",
            "name": "Damage to Property",
            "description": "Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems. This technique may result in device and operational equipment breakdown, or represent tangential damage from other techniques used in an attack. Depending on the severity of physical damage and disruption caused to control processes and systems, this technique may result in [Loss of Safety](https://attack.mitre.org/techniques/T0880). Operations that result in [Loss of Control](https://attack.mitre.org/techniques/T0827) may also cause damage to property, which may be directly or indirectly motivated by an adversary seeking to cause impact in the form of [Loss of Productivity and Revenue](https://attack.mitre.org/techniques/T0828). \n\n\nThe German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill under an incidents affecting business section of its 2014 IT Security Report. (Citation: BSI State of IT Security 2014)  These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact and damage resulted from the uncontrolled shutdown of a blast furnace. \n\nA Polish student used a remote controller device to interface with the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) (Citation: Bruce Schneier January 2008) Using this remote, the student was able to capture and replay legitimate tram signals. This resulted in damage to impacted trams, people, and the surrounding property. Reportedly, four trams were derailed and were forced to make emergency stops. (Citation: Shelley Smith February 2008) Commands issued by the student may have also resulted in tram collisions, causing harm to those on board and the environment outside. (Citation: Bruce Schneier January 2008)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8535b71e-3c12-4258-a4ab-40257a1becc4",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0856",
                    "external_id": "T0856"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:43.011Z",
            "name": "Spoof Reporting Message",
            "description": "Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values. \n\nIf an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0866",
                    "external_id": "T0866"
                },
                {
                    "source_name": "Enterprise ATT&CK",
                    "description": "Enterprise ATT&CK   Exploitation of Remote Services Retrieved. 2019/10/27 ",
                    "url": "https://attack.mitre.org/techniques/T1210/"
                },
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:44.918Z",
            "name": "Exploitation of Remote Services",
            "description": "Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service abuse. A common goal for post-compromise exploitation of remote services is for initial access into and lateral movement throughout the ICS environment to enable access to targeted systems. (Citation: Enterprise ATT&CK)\n\nICS asset owners and operators have been affected by ransomware (or disruptive malware masquerading as ransomware) migrating from enterprise IT to ICS environments: WannaCry, NotPetya, and BadRabbit. In each of these cases, self-propagating (wormable) malware initially infected IT networks, but through exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks, producing significant impacts. (Citation: Joe Slowik April 2019)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0812",
                    "external_id": "T0812"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:48.356Z",
            "name": "Default Credentials",
            "description": "Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed. (Citation: Keith Stouffer May 2015)\n\nDefault credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0822",
                    "external_id": "T0822"
                },
                {
                    "source_name": "Daniel Oakley, Travis Smith, Tripwire",
                    "description": "Daniel Oakley, Travis Smith, Tripwire   Retrieved. 2018/05/30 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1133"
                },
                {
                    "source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ",
                    "url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:54.492Z",
            "name": "External Remote Services",
            "description": "Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. (Citation: Daniel Oakley, Travis Smith, Tripwire)\n\nExternal remote services allow administration of a control system from outside the system. Often, vendors and internal engineering groups have access to external remote services to control system networks via the corporate network. In some cases, this access is enabled directly from the internet. While remote access enables ease of maintenance when a control system is in a remote area, compromise of remote access solutions is a liability. The adversary may use these services to gain access to and execute attacks against a control system network. Access to valid accounts is often a requirement. \n\nAs they look for an entry point into the control system network, adversaries may begin searching for existing point-to-point VPN implementations at trusted third party networks or through remote support employee connections where split tunneling is enabled. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0806",
                    "external_id": "T0806"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:36.943Z",
            "name": "Brute Force I/O",
            "description": "Adversaries may repetitively or successively change I/O point values to perform an action. Brute Force I/O may be achieved by changing either a range of I/O point values or a single point value repeatedly to manipulate a process function. The adversary's goal and the information they have about the target environment will influence which of the options they choose. In the case of brute forcing a range of point values, the adversary may be able to achieve an impact without targeting a specific point. In the case where a single point is targeted, the adversary may be able to generate instability on the process function associated with that particular point. \n\nAdversaries may use Brute Force I/O to cause failures within various industrial processes. These failures could be the result of wear on equipment or damage to downstream equipment.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--94f042ae-3033-4a8d-9ec3-26396533a541",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0870",
                    "external_id": "T0870"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:07.297Z",
            "name": "Detect Program State",
            "description": "Adversaries may seek to gather information about the current state of a program on a PLC. State information reveals information about the program, including whether it's running, halted, stopped, or has generated an exception. This information may be leveraged as a verification of malicious program execution or to determine if a PLC is ready to download a new program.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0830",
                    "external_id": "T0830"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                },
                {
                    "source_name": "Gabriel Sanchez October 2017",
                    "description": "Gabriel Sanchez 2017, October Man-In-The-Middle Attack Against Modbus TCP Illustrated with Wireshark Retrieved. 2020/01/05 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/man-in-the-middle-attack-modbus-tcp-illustrated-wireshark-38095"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:43.971Z",
            "name": "Adversary-in-the-Middle",
            "description": "Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. (Citation: Gabriel Sanchez October 2017) This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)  \n\nAn AiTM attack may allow an adversary to perform the following attacks:  \n[Block Reporting Message](https://attack.mitre.org/techniques/T0804), [Spoof Reporting Message](https://attack.mitre.org/techniques/T0856), [Modify Parameter](https://attack.mitre.org/techniques/T0836), [Unauthorized Command Message](https://attack.mitre.org/techniques/T0855)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Conrad Layne - GE Digital"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "2.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0820",
                    "external_id": "T0820"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:51.921Z",
            "name": "Exploitation for Evasion",
            "description": "Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features.  \n\nAdversaries may have prior knowledge through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888) about security features implemented on control devices. These device security features will likely be targeted directly for exploitation. There are examples of firmware RAM/ROM consistency checks on control devices being targeted by adversaries to enable the installation of malicious [System Firmware](https://attack.mitre.org/techniques/T0857).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0827",
                    "external_id": "T0827"
                },
                {
                    "source_name": "BSI State of IT Security 2014",
                    "description": "Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 ",
                    "url": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.706Z",
            "name": "Loss of Control",
            "description": "Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)\n\nThe German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill in its 2014 IT Security Report.(Citation: BSI State of IT Security 2014) These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact resulted in damage and unsafe conditions from the uncontrolled shutdown of a blast furnace.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Dragos Threat Intelligence"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--a8cfd474-9358-464f-a169-9c6f099a8e8a",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0875",
                    "external_id": "T0875"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:11.949Z",
            "name": "Change Program State",
            "description": "Adversaries may attempt to change the state of the current program on a control device. Program state changes may be used to allow for another program to take over control or be loaded onto the device.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0874",
                    "external_id": "T0874"
                },
                {
                    "source_name": "Enterprise ATT&CK",
                    "description": "Enterprise ATT&CK   Hooking Retrieved. 2019/10/27 ",
                    "url": "https://attack.mitre.org/techniques/T1179/"
                },
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:33.137Z",
            "name": "Hooking",
            "description": "Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means. Windows processes often leverage these API functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. (Citation: Enterprise ATT&CK)\n\nOne type of hooking seen in ICS involves redirecting calls to these functions via import address table (IAT) hooking. IAT hooking uses modifications to a process IAT, where pointers to imported API functions are stored. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "privilege-escalation"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--abb0a255-eb9c-48d0-8f5c-874bb84c0e45",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0808",
                    "external_id": "T0808"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:12.937Z",
            "name": "Control Device Identification",
            "description": "Adversaries may perform control device identification to determine the make and model of a target device. Management software and device APIs may be utilized by the adversary to gain this information. By identifying and obtaining device specifics, the adversary may be able to determine device vulnerabilities. This device information can also be used to understand device functionality and inform the decision to target the environment.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0844",
                    "external_id": "T0844"
                },
                {
                    "source_name": "Guidance - IEC61131",
                    "description": "John Karl-Heinz. (n.d.). Programming Industrial Automation Systems. Retrieved October 22, 2019.",
                    "url": "http://www.dee.ufrj.br/controle%20automatico/cursos/IEC61131-3%20Programming%20Industrial%20Automation%20Systems.pdf"
                },
                {
                    "source_name": "PLCBlaster - Spenneberg",
                    "description": "Spenneberg, Ralf, Maik Brüggemann, and Hendrik Schwartke. (2016, March 31). Plc-blaster: A worm living solely in the plc.. Retrieved September 19, 2017.",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                },
                {
                    "source_name": "Stuxnet - Symantec - 201102",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier (Version 1.4). Retrieved September 22, 2017.",
                    "url": "https://www.symantec.com/content/en/us/enterprise/media/security%20response/whitepapers/w32%20stuxnet%20dossier.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:13.466Z",
            "name": "Program Organization Units",
            "description": "Program Organizational Units (POUs) are block structures used within PLC programming to create programs and projects. (Citation: Guidance - IEC61131) POUs can be used to hold user programs written in IEC 61131-3 languages: Structured text, Instruction list, Function block, and Ladder logic. (Citation: Guidance - IEC61131) Application - 201203 They can also provide additional functionality, such as establishing connections between the PLC and other devices using TCON. (Citation: PLCBlaster - Spenneberg)\n  \nStuxnet uses a simple code-prepending infection technique to infect Organization Blocks (OB). For example, the following sequence of actions is performed when OB1 is infected  (Citation: Stuxnet - Symantec - 201102):\n*Increase the size of the original block.\n*Write malicious code to the beginning of the block.\n*Insert the original OB1 code after the malicious code.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Safety Instrumented System/Protection Relay",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0823",
                    "external_id": "T0823"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:46.244Z",
            "name": "Graphical User Interface",
            "description": "Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard.\n\nIf physical access is not an option, then access might be possible via protocols such as VNC on Linux-based and Unix-based operating systems, and RDP on Windows operating systems. An adversary can use this access to execute programs and applications on the target machine.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0848",
                    "external_id": "T0848"
                },
                {
                    "source_name": "Bastille April 2017",
                    "description": "Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 ",
                    "url": "https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack"
                },
                {
                    "source_name": "Zack Whittaker April 2017",
                    "description": "Zack Whittaker 2017, April 12 Dallas' emergency sirens were hacked with a rogue radio signal Retrieved. 2020/11/06 ",
                    "url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:50.906Z",
            "name": "Rogue Master",
            "description": "Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. \n\nIn the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "created": "2021-04-13T12:36:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0834",
                    "external_id": "T0834"
                },
                {
                    "source_name": "The MITRE Corporation May 2017",
                    "description": "The MITRE Corporation 2017, May 31 ATT&CK T1106: Native API Retrieved. 2021/04/26 ",
                    "url": "https://attack.mitre.org/techniques/T1106/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:41.765Z",
            "name": "Native API",
            "description": "Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. (Citation: The MITRE Corporation May 2017) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. \n\nFunctionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0826",
                    "external_id": "T0826"
                },
                {
                    "source_name": "Colonial Pipeline Company May 2021",
                    "description": "Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 ",
                    "url": "https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-15T19:59:00.088Z",
            "name": "Loss of Availability",
            "description": "Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) \n\nAdversaries may leverage malware to delete or encrypt critical data on HMIs, workstations, or databases.\n\nIn the 2021 Colonial Pipeline ransomware incident, pipeline operations were temporally halted on May 7th and were not fully restarted until May 12th. (Citation: Colonial Pipeline Company May 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0882",
                    "external_id": "T0882"
                },
                {
                    "source_name": "Danny Yadron December 2015",
                    "description": "Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 ",
                    "url": "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559"
                },
                {
                    "source_name": "Mark Thompson March 2016",
                    "description": "Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 ",
                    "url": "https://time.com/4270728/iran-cyber-attack-dam-fbi/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.709Z",
            "name": "Theft of Operational Information",
            "description": "Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations.    In the Bowman Dam incident, adversaries probed systems for operational data. (Citation: Mark Thompson March 2016) (Citation: Danny Yadron December 2015)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b9160e77-ea9e-4ba9-b1c8-53a3c466b13d",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0857",
                    "external_id": "T0857"
                },
                {
                    "source_name": "Basnight, Zachry, et al.",
                    "description": "Basnight, Zachry, et al. 2013 Retrieved. 2017/10/17 ",
                    "url": "http://www.sciencedirect.com/science/article/pii/S1874548213000231"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:44.575Z",
            "name": "System Firmware",
            "description": "System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network. \n\nAn adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers. (Citation: Basnight, Zachry, et al.)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0849",
                    "external_id": "T0849"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:34.261Z",
            "name": "Masquerading",
            "description": "Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions. \n\nApplications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0843",
                    "external_id": "T0843"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:41.446Z",
            "name": "Program Download",
            "description": "Adversaries may perform a program download to transfer a user program to a controller. \n\nVariations of program download, such as online edit and program append, allow a controller to continue running during the transfer and reconfiguration process without interruption to process control. However, before starting a full program download (i.e., download all) a controller may need to go into a stop state. This can have negative consequences on the physical process, especially if the controller is not able to fulfill a time-sensitive action. Adversaries may choose to avoid a download all in favor of an online edit or program append to avoid disrupting the physical process. An adversary may need to use the technique Detect Operating Mode or Change Operating Mode to make sure the controller is in the proper mode to accept a program download.\n\nThe granularity of control to transfer a user program in whole or parts is dictated by the management protocol (e.g., S7CommPlus, TriStation) and underlying controller API. Thus, program download is a high-level term for the suite of vendor-specific API calls used to configure a controllers user program memory space.  \n\n[Modify Controller Tasking](https://attack.mitre.org/techniques/T0821) and [Modify Program](https://attack.mitre.org/techniques/T0889) represent the configuration changes that are transferred to a controller via a program download.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0847",
                    "external_id": "T0847"
                },
                {
                    "source_name": "BBC April 2016",
                    "description": "BBC 2016, April 28 German nuclear plant hit by computer viruses Retrieved. 2019/10/14 ",
                    "url": "https://www.bbc.com/news/technology-36158606"
                },
                {
                    "source_name": "Catalin Cimpanu April 2016",
                    "description": "Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 ",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                },
                {
                    "source_name": "Christoph Steitz, Eric Auchard April 2016",
                    "description": "Christoph Steitz, Eric Auchard 2016, April 26 German nuclear plant infected with computer viruses, operator says Retrieved. 2019/10/14 ",
                    "url": "https://www.reuters.com/article/us-nuclearpower-cyber-germany/german-nuclear-plant-infected-with-computer-viruses-operator-says-idUSKCN0XN2OS"
                },
                {
                    "source_name": "Dark Reading Staff April 2016",
                    "description": "Dark Reading Staff 2016, April 28 German Nuclear Power Plant Infected With Malware Retrieved. 2019/10/14 ",
                    "url": "https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298"
                },
                {
                    "source_name": "ESET April 2016",
                    "description": "ESET 2016, April 28 Malware found at a German nuclear power plant Retrieved. 2019/10/14 ",
                    "url": "https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/"
                },
                {
                    "source_name": "Kernkraftwerk Gundremmingen April 2016",
                    "description": "Kernkraftwerk Gundremmingen 2016, April 25 Detektion von Bro-Schadsoftware an mehreren Rechnern Retrieved. 2019/10/14 ",
                    "url": "https://www.kkw-gundremmingen.de/presse.php?id=571"
                },
                {
                    "source_name": "Lee Mathews April 2016",
                    "description": "Lee Mathews 2016, April 27 German nuclear plant found riddled with Conficker, other viruses. Retrieved November 17, 2024. ",
                    "url": "https://web.archive.org/web/20160430041256/https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/"
                },
                {
                    "source_name": "Peter Dockrill April 2016",
                    "description": "Peter Dockrill 2016, April 28 Multiple Computer Viruses Have Been Discovered in This German Nuclear Plant Retrieved. 2019/10/14 ",
                    "url": "https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant"
                },
                {
                    "source_name": "Sean Gallagher April 2016",
                    "description": "Sean Gallagher 2016, April 27 German nuclear plants fuel rod system swarming with old malware Retrieved. 2019/10/14 ",
                    "url": "https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/"
                },
                {
                    "source_name": "Trend Micro April 2016",
                    "description": "Trend Micro 2016, April 27 Malware Discovered in German Nuclear Power Plant Retrieved. 2019/10/14 ",
                    "url": "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/malware-discovered-in-german-nuclear-power-plant"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:36.055Z",
            "name": "Replication Through Removable Media",
            "description": "Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment. The adversary may rely on unknowing trusted third parties, such as suppliers or contractors with access privileges, to introduce the removable media. This technique enables initial access to target devices that never connect to untrusted networks, but are physically accessible.     \n\nOperators of the German nuclear power plant, Gundremmingen, discovered malware on a facility computer not connected to the internet. (Citation: Kernkraftwerk Gundremmingen April 2016) (Citation: Trend Micro April 2016) The malware included Conficker and W32.Ramnit, which were also found on eighteen removable disk drives in the facility. (Citation: Christoph Steitz, Eric Auchard April 2016) (Citation: Catalin Cimpanu April 2016) (Citation: Peter Dockrill April 2016) (Citation: Lee Mathews April 2016) (Citation: Sean Gallagher April 2016) (Citation: Dark Reading Staff April 2016) The plant has since checked for infection and cleaned up more than 1,000 computers. (Citation: BBC April 2016) An ESET researcher commented that internet disconnection does not guarantee system safety from infection or payload execution. (Citation: ESET April 2016)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "created": "2026-04-20T20:54:21.227Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0846/002",
                    "external_id": "T0846.002"
                },
                {
                    "source_name": "Cisco Active Discovery",
                    "description": "Cisco Systems, Inc.. (2024, March 5). Cisco Cyber Vision Active Discovery Configuration Guide, Release 4.3.0. Retrieved April 23, 2026.",
                    "url": "https://www.cisco.com/c/en/us/td/docs/security/cyber_vision/publications/Active-Discovery/Release-4-3-0/b_Cisco_Cyber_Vision_Active_Discovery_Configuration_Guide.pdf"
                },
                {
                    "source_name": "Broadcasting BACnet",
                    "description": "H. Michael Newman. (2010, November). Broadcasting BACnet®. Retrieved April 23, 2026.",
                    "url": "https://bacnet.org/wp-content/uploads/sites/4/2022/06/Newman_2010.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:57.430Z",
            "name": "Broadcast Discovery",
            "description": "Adversaries may perform broadcast discovery requests to enumerate systems and devices on a network. Broadcast discovery works by one system or device sending messages to all systems and devices on a network (or subnet) and then waiting for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol. Adversaries may leverage different protocols supported on the network for sending broadcast messages. \n\nSome common OT protocols that have broadcast discovery mechanisms are Building Automation and Control Network (BACNet) Who-Is requests, Common Industrial Protocol (CIP) List Identity User Datagram Protocol (UDP) broadcast requests, and Siemens S7 broadcast identification requests.(Citation: Broadcasting BACnet)(Citation: Cisco Active Discovery)\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0852",
                    "external_id": "T0852"
                },
                {
                    "source_name": "ICS-CERT October 2017",
                    "description": "ICS-CERT 2017, October 21 Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors Retrieved. 2017/10/23 ",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA17-293A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:40.879Z",
            "name": "Screen Capture",
            "description": "Adversaries may attempt to perform screen capture of devices in the control system environment. Screenshots may be taken of workstations, HMIs, or other devices that display environment-relevant process, device, reporting, alarm, or related data. These device displays may reveal information regarding the ICS process, layout, control, and related schematics. In particular, an HMI can provide a lot of important industrial process information. (Citation: ICS-CERT October 2017) Analysis of screen captures may provide the adversary with an understanding of intended operations and interactions between critical devices.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--c9a8d958-fcdb-40d2-af4c-461c8031651a",
            "created": "2022-09-29T13:35:38.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0891",
                    "external_id": "T0891"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:49.917Z",
            "name": "Hardcoded Credentials",
            "description": "Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset. Examples credentials that may be hardcoded in an asset include:\n\n* Username/Passwords\n* Cryptographic keys/Certificates\n* API tokens\n\nUnlike [Default Credentials](https://attack.mitre.org/techniques/T0812), these credentials are built into the system in a way that they either cannot be changed by the asset owner, or may be infeasible to change because of the impact it would cause to the control system operation. These credentials may be reused across whole product lines or device models and are often not published or known to the owner and operators of the asset. \n\nAdversaries may utilize these hardcoded credentials to move throughout the control system environment or provide reliable access for their tools to interact with industrial assets. \n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Aagam Shah, @neutrinoguy, ABB"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0859",
                    "external_id": "T0859"
                },
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:33.956Z",
            "name": "Valid Accounts",
            "description": "Adversaries may steal the credentials of a specific user or service account using credential access techniques. In some cases, default credentials for control system devices may be publicly available. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network, and may even be used for persistent access to remote systems. Compromised and default credentials may also grant an adversary increased privilege to specific systems and devices or access to restricted areas of the network. Adversaries may choose not to use malware or tools, in conjunction with the legitimate access those credentials provide, to make it harder to detect their presence or to control devices and send legitimate commands in an unintended way. \n\nAdversaries may also create accounts, sometimes using predefined account names and passwords, to provide a means of backup access for persistence. (Citation: Booz Allen Hamilton) \n\nThe overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator)  and possibly between the enterprise and operational technology environments. Adversaries may be able to leverage valid credentials from one system to gain access to another system.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0890",
                    "external_id": "T0890"
                },
                {
                    "source_name": "The MITRE Corporation",
                    "description": "The MITRE Corporation The MITRE Corporation   ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12  ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 ",
                    "url": "https://attack.mitre.org/techniques/T1068/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:37.232Z",
            "name": "Exploitation for Privilege Escalation",
            "description": "Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. (Citation: The MITRE Corporation) \n\nWhen initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. (Citation: The MITRE Corporation)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "privilege-escalation"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0846",
                    "external_id": "T0846"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 Remote System Discovery Retrieved. 2018/05/17 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1018"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:37.554Z",
            "name": "Remote System Discovery",
            "description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used.(Citation: Enterprise ATT&CK January 2018)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d614a9cf-18eb-4800-81e4-ab8ddf0baa73",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0818",
                    "external_id": "T0818"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:27.888Z",
            "name": "Engineering Workstation Compromise",
            "description": "Adversaries will compromise and gain control of an engineering workstation for Initial Access into the control system environment. Access to an engineering workstation may occur through or physical means, such as a Valid Accounts with privileged access or infection by removable media. A dual-homed engineering workstation may allow the adversary access into multiple networks. For example, unsegregated process control, safety system, or information system networks. An Engineering Workstation is designed as a reliable computing platform that configures, maintains, and diagnoses control system equipment and applications. Compromise of an engineering workstation may provide access to, and control of, other control system applications and equipment. In the Maroochy attack, the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Joe Slowik - Dragos"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Engineering Workstation"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0884",
                    "external_id": "T0884"
                },
                {
                    "source_name": "Enterprise ATT&CK January 2018",
                    "description": "Enterprise ATT&CK 2018, January 11 Connection Proxy Retrieved. 2018/05/17 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1090"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:43.335Z",
            "name": "Connection Proxy",
            "description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.\n\nThe definition of a proxy can also be expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted connections between networks consisting of hosts or systems that regularly communicate with each other.\n\nThe network may be within a single organization or across multiple organizations with trust relationships. Adversaries could use these types of relationships to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. (Citation: Enterprise ATT&CK January 2018)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "command-and-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "created": "2026-04-20T20:54:25.372Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0843/002",
                    "external_id": "T0843.002"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:59.738Z",
            "name": "Online Edit",
            "description": "Adversaries may execute an online edit of a PLC to update parts of an existing program. It does not require stopping the PLC which allows it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection. \n\nThe ability to perform an online edit to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0869",
                    "external_id": "T0869"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:53.199Z",
            "name": "Standard Application Layer Protocol",
            "description": "Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port.  Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "command-and-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e0d74479-86d2-465d-bf36-903ebecef43e",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0833",
                    "external_id": "T0833"
                },
                {
                    "source_name": "Stuxnet - Langner - 201311",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved March 27, 2018.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                },
                {
                    "source_name": "Maroochy - MITRE - 200808",
                    "description": "Marshall Abrams. (2008, July 23). Malicious Control System Cyber Security Attack Case Study– Maroochy Water Services, Australia. Retrieved March 27, 2018.",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08%201145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:30.517Z",
            "name": "Modify Control Logic",
            "description": "Adversaries may place malicious code in a system, which can cause the system to malfunction by modifying its control logic. Control system devices use programming languages (e.g. relay ladder logic) to control physical processes by affecting actuators, which cause machines to operate, based on environment sensor readings. These devices often include the ability to perform remote control logic updates. \n\nProgram code is normally edited in a vendor-specific Integrated Development Environment (IDE) that relies on proprietary tools and features. These IDEs allow an engineer to perform host target development and may have the ability to run the code on the machine it is programmed for. The IDE will transmit the control logic to the testing device, and will perform the required device-specific functions to apply the changes and make them active.\n\nAn adversary may attempt to use this host target IDE to modify device control logic. Even though proprietary tools are often used to edit and update control logic, the process can usually be reverse-engineered and reproduced with open-source tools.\n\nAn adversary can de-calibrate a sensor by removing functions in control logic that account for sensor error. This can be used to change a control process without actually spoofing command messages to a controller or device. \n\nIt is believed this process happened in the lesser known over-pressurizer attacks build into Stuxnet. Pressure sensors are not perfect at translating pressure into an analog output signal, but their errors can be corrected by calibration. The pressure controller can be told what the “real” pressure is for given analog signals and then automatically linearize the measurement to what would be the “real” pressure. If the linearization is overwritten by malicious code on the S7-417 controller, analog pressure readings will be “corrected” during the attack by the pressure controller, which then interprets all analog pressure readings as perfectly normal pressure no matter how high or low their analog values are. The pressure controller then acts accordingly by never opening the stage exhaust valves. In the meantime, actual pressure keeps rising. (Citation: Stuxnet - Langner - 201311)\n\nIn the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed by Hunter Watertech for its use in changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. (Citation: Maroochy - MITRE - 200808)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Safety Instrumented System/Protection Relay",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "created": "2026-04-20T20:50:34.487Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1692",
                    "external_id": "T1692"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:55.183Z",
            "name": "Unauthorized Message",
            "description": "Adversaries may send unauthorized messages to ICS systems and devices to evade defenses or manipulate processes. Unauthorized messages can be categorized as either reporting messages that contain telemetry data about the current state of systems, devices, and processes or as command messages which instruct systems and devices on how to operate. By injecting unauthorized messages, adversaries can make it appear as if everything is working correctly when it isn’t, trigger alarms to misdirect personnel or impact processes, and manipulate controls to disrupt processes.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\n\nAdversaries may send unauthorized messages in an ICS environment using software found within the environment (living-off-the-land, vendor-specific interfaces, etc.), custom tooling leveraging OT protocols and libraries, or by positioning themselves between systems and devices and injecting messages into the communications such as the case with an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "evasion"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "created": "2021-04-12T19:26:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0886",
                    "external_id": "T0886"
                },
                {
                    "source_name": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
                    "description": "Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
                },
                {
                    "source_name": "Dragos December 2017",
                    "description": "Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 ",
                    "url": "https://dragos.com/blog/trisis/TRISIS-01.pdf"
                },
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:54.826Z",
            "name": "Remote Services",
            "description": "Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: Joe Slowik April 2019) \n\nRemote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) to multiple network segments, and can be used for [Program Download](https://attack.mitre.org/techniques/T0843) or to execute attacks on control devices directly through [Valid Accounts](https://attack.mitre.org/techniques/T0859).\n\nSpecific remote services (RDP & VNC) may be a precursor to enable [Graphical User Interface](https://attack.mitre.org/techniques/T0823) execution on devices such as HMIs or engineering workstation software.\n\nBased on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks.  (Citation: CISA AA21-201A Pipeline Intrusion July 2021)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Daisuke Suzuki"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e2994b6a-122b-4043-b654-7411c5198ec0",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-ics-attack",
                    "url": "https://attack.mitre.org/techniques/T0824",
                    "external_id": "T0824"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-24T17:49:30.966Z",
            "name": "I/O Module Discovery",
            "description": "Adversaries may use input/output (I/O) module discovery to gather key information about a control system device. An I/O module is a device that allows the control system device to either receive or send signals to other devices. These signals can be analog or digital, and may support a number of different protocols. Devices are often able to use attachable I/O modules to increase the number of inputs and outputs that it can utilize. An adversary with access to a device can use native device functions to enumerate I/O modules that are connected to the device. Information regarding the I/O modules can aid the adversary in understanding related control processes.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Field Controller/RTU/PLC/IED"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0813",
                    "external_id": "T0813"
                },
                {
                    "source_name": "Corero",
                    "description": "Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04 ",
                    "url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
                },
                {
                    "source_name": "Mark Loveless April 2017",
                    "description": "Mark Loveless 2017, April 11 THE DALLAS COUNTY SIREN HACK Retrieved. 2020/11/06 ",
                    "url": "https://duo.com/decipher/the-dallas-county-siren-hack"
                },
                {
                    "source_name": "Michael J. Assante and Robert M. Lee",
                    "description": "Michael J. Assante and Robert M. Lee SANS Industrial Control System (ICS) Security; The Industrial Control System Cyber Kill Chain Retrieved 2024/11/25",
                    "url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
                },
                {
                    "source_name": "Tyson Macaulay",
                    "description": "Tyson Macaulay Michael J. Assante and Robert M. Lee Corero   Industrial Control System (ICS) Security Retrieved. 2019/11/04  The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04  RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ",
                    "url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-15T19:59:15.775Z",
            "name": "Denial of Control",
            "description": "Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls. An adversary may attempt to deny process control access to cause a temporary loss of communication with the control device or to prevent operator adjustment of process controls. An affected process may still be operating during the period of control loss, but not necessarily in a desired state. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)\n\nIn the 2017 Dallas Siren incident operators were unable to disable the false alarms from the Office of Emergency Management headquarters. (Citation: Mark Loveless April 2017)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impact"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0838",
                    "external_id": "T0838"
                },
                {
                    "source_name": "Jos Wetzels, Marina Krotofil 2019",
                    "description": "Jos Wetzels, Marina Krotofil 2019 A Diet of Poisoned Fruit: Designing Implants & OT Payloads for ICS Embedded Devices Retrieved. 2019/11/01 ",
                    "url": "https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:47.496Z",
            "name": "Modify Alarm Settings",
            "description": "Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes. \n\nIf an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a [Impact](https://attack.mitre.org/tactics/TA0105) could occur. \n\nIn ICS environments, the adversary may have to use [Alarm Suppression](https://attack.mitre.org/techniques/T0878) or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019)  Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code. ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0885",
                    "external_id": "T0885"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:36.649Z",
            "name": "Commonly Used Port",
            "description": "Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection. They may use the protocol associated with the port, or a completely different protocol. They may use commonly open ports, such as the examples provided below. \n \n * TCP:80 (HTTP) \n * TCP:443 (HTTPS) \n * TCP/UDP:53 (DNS) \n * TCP:1024-4999 (OPC on XP/Win2k3) \n * TCP:49152-65535 (OPC on Vista and later) \n * TCP:23 (TELNET) \n * UDP:161 (SNMP) \n * TCP:502 (MODBUS) \n * TCP:102 (S7comm/ISO-TSAP) \n * TCP:20000 (DNP3) \n * TCP:44818 (Ethernet/IP)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "command-and-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Matan Dobrushin - Otorio"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0873",
                    "external_id": "T0873"
                },
                {
                    "source_name": "Beckhoff",
                    "description": "Beckhoff   TwinCAT 3 Source Control: Project Files Retrieved. 2019/11/21 ",
                    "url": "https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_sourcecontrol/18014398915785483.html&id="
                },
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                },
                {
                    "source_name": "PLCdev",
                    "description": "PLCdev Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22  Siemens SIMATIC Step 7 Programmer's Handbook Retrieved. 2019/11/21 ",
                    "url": "http://www.plcdev.com/book/export/html/373"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:44.597Z",
            "name": "Project File Infection",
            "description": "Adversaries may attempt to infect project files with malicious code. These project files may consist of objects, program organization units, variables such as tags, documentation, and other configurations needed for PLC programs to function.(Citation: Beckhoff) Using built in functions of the engineering software, adversaries may be able to download an infected program to a PLC in the operating environment enabling further [Execution](https://attack.mitre.org/tactics/TA0104) and [Persistence](https://attack.mitre.org/tactics/TA0110) techniques.(Citation: PLCdev) \n\nAdversaries may export their own code into project files with conditions to execute at specific intervals.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) Malicious programs allow adversaries control of all aspects of the process enabled by the PLC. Once the project file is downloaded to a PLC the workstation device may be disconnected with the infected project file still executing.(Citation: PLCdev)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0840",
                    "external_id": "T0840"
                },
                {
                    "source_name": "MITRE",
                    "description": "MITRE   System Network Connections Discovery Retrieved. 2018/05/31 ",
                    "url": "https://attack.mitre.org/wiki/Technique/T1049"
                },
                {
                    "source_name": "Netstat",
                    "description": "Wikipedia. (n.d.). Netstat. Retrieved May 23, 2022.",
                    "url": "https://en.wikipedia.org/wiki/Netstat"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:45.539Z",
            "name": "Network Connection Enumeration",
            "description": "Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as Netstat(Citation: Netstat), in conjunction with [System Firmware](https://attack.mitre.org/techniques/T0857), then they can determine the role of certain devices on the network  (Citation: MITRE). The adversary can also use [Network Sniffing](https://attack.mitre.org/techniques/T0842) to watch network traffic for details about the source, destination, protocol, and content.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "discovery"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0867",
                    "external_id": "T0867"
                },
                {
                    "source_name": "Enterprise ATT&CK",
                    "description": "Enterprise ATT&CK Enterprise ATT&CK   Lateral Tool Transfer Retrieved. 2019/10/27  Lateral Tool Transfer Retrieved. 2019/10/27 ",
                    "url": "https://attack.mitre.org/techniques/T1570/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:39.341Z",
            "name": "Lateral Tool Transfer",
            "description": "Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.(Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.(Citation: Enterprise ATT&CK)\n\nIn control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "lateral-movement"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": true,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0839",
                    "external_id": "T0839"
                },
                {
                    "source_name": "Daniel Peck,  Dale Peterson January 2009",
                    "description": "Daniel Peck,  Dale Peterson 2009, January 28 Leveraging Ethernet Card Vulnerabilities in Field Devices Retrieved. 2017/12/19 ",
                    "url": "https://www.researchgate.net/publication/228849043_Leveraging_ethernet_card_vulnerabilities_in_field_devices"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:46.789Z",
            "name": "Module Firmware",
            "description": "Adversaries may install malicious or vulnerable firmware onto modular hardware devices. Control system devices often contain modular hardware devices. These devices may have their own set of firmware that is separate from the firmware of the main control system equipment.   \n\nThis technique is similar to [System Firmware](https://attack.mitre.org/techniques/T0857), but is conducted on other system components that may not have the same capabilities or level of integrity checking. Although it results in a device re-image, malicious device firmware may provide persistent access to remaining devices. (Citation: Daniel Peck,  Dale Peterson January 2009)  \n\nAn easy point of access for an adversary is the Ethernet card, which may have its own CPU, RAM, and operating system. The adversary may attack and likely exploit the computer on an Ethernet card. Exploitation of the Ethernet card computer may enable the adversary to accomplish additional attacks, such as the following: (Citation: Daniel Peck,  Dale Peterson January 2009)  \n\n* Delayed Attack - The adversary may stage an attack in advance and choose when to launch it, such as at a particularly damaging time.  \n* Brick the Ethernet Card - Malicious firmware may be programmed to result in an Ethernet card failure, requiring a factory return.  \n* Random Attack or Failure - The adversary may load malicious firmware onto multiple field devices. Execution of an attack and the time it occurs is generated by a pseudo-random number generator.   \n* A Field Device Worm - The adversary may choose to identify all field devices of the same model, with the end goal of performing a device-wide compromise.  \n* Attack Other Cards on the Field Device - Although it is not the most important module in a field device, the Ethernet card is most accessible to the adversary and malware. Compromise of the Ethernet card may provide a more direct route to compromising other modules, such as the CPU module.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                },
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "impair-process-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_version": "1.1"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "created": "2020-05-21T17:43:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0883",
                    "external_id": "T0883"
                },
                {
                    "source_name": "Danny Yadron December 2015",
                    "description": "Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 ",
                    "url": "https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559"
                },
                {
                    "source_name": "Mark Thompson March 2016",
                    "description": "Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 ",
                    "url": "https://time.com/4270728/iran-cyber-attack-dam-fbi/"
                },
                {
                    "source_name": "NCCIC January 2014",
                    "description": "NCCIC 2014, January 1 Internet Accessible Control Systems At Risk Retrieved. 2019/11/07 ",
                    "url": "https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf"
                },
                {
                    "source_name": "Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler",
                    "description": "Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07  Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats Retrieved. 2021/04/12 ",
                    "url": "https://documents.trendmicro.com/assets/white_papers/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:52.237Z",
            "name": "Internet Accessible Device",
            "description": "Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through [External Remote Services](https://attack.mitre.org/techniques/T0822). Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T0819) technique.\n\nAdversaries may leverage built in functions for remote access which may not be protected or utilize minimal legacy protections that may be targeted. (Citation: NCCIC January 2014) These services may be discoverable through the use of online scanning tools. \n\nIn the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing. (Citation: NCCIC January 2014) (Citation: Danny Yadron December 2015) (Citation: Mark Thompson March 2016)\n\nIn Trend Micros manufacturing deception operations adversaries were detected leveraging direct internet access to an ICS environment through the exposure of operational protocols such as Siemens S7, Omron FINS, and EtherNet/IP, in addition to misconfigured VNC access. (Citation: Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "initial-access"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "created": "2023-03-30T18:56:02.424Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0893",
                    "external_id": "T0893"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:40.258Z",
            "name": "Data from Local System",
            "description": "Adversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes.\n\nAdversaries may do this using [Command-Line Interface](https://attack.mitre.org/techniques/T0807) or [Scripting](https://attack.mitre.org/techniques/T0853) techniques to interact with the file system to gather information. Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T0802) on the local system. ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "collection"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "created": "2023-03-30T14:04:17.023Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0892",
                    "external_id": "T0892"
                },
                {
                    "source_name": "German BAS Lockout Dec 2021",
                    "description": "Kelly Jackson Higgins. (2021, December 20). Lights Out: Cyberattacks Shut Down Building Automation Systems. Retrieved March 30, 2023.",
                    "url": "https://www.darkreading.com/attacks-breaches/lights-out-cyberattacks-shut-down-building-automation-systems"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:45.931Z",
            "name": "Change Credential",
            "description": "Adversaries may modify software and device credentials to prevent operator and responder access. Depending on the device, the modification or addition of this password could prevent any device configuration actions from being accomplished and may require a factory reset or replacement of hardware. These credentials are often built-in features provided by the device vendors as a means to restrict access to management interfaces.\n\nAn adversary with access to valid or hardcoded credentials could change the credential to prevent future authorized device access. Change Credential may be especially damaging when paired with other techniques such as Modify Program, Data Destruction, or Modify Controller Tasking. In these cases, a device’s configuration may be destroyed or include malicious actions for the process environment, which cannot not be removed through normal device configuration actions. \n\nAdditionally, recovery of the device and original configuration may be difficult depending on the features provided by the device. In some cases, these passwords cannot be removed onsite and may require that the device be sent back to the vendor for additional recovery steps.\n\n\nA chain of incidents occurred in Germany, where adversaries locked operators out of their building automation system (BAS) controllers by enabling a previously unset BCU key. (Citation: German BAS Lockout Dec 2021) \n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_contributors": [
                "Felix Eberstaller"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "created": "2026-04-20T20:50:35.776Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1695",
                    "external_id": "T1695"
                },
                {
                    "source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
                    "description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
                    "url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:58.081Z",
            "name": "Block Communications",
            "description": "Operational technology communications occur over serial COM, Ethernet, Wi-Fi, cellular (4G/5G), and satellite mediums. Adversaries may block communications to prevent reporting messages and command messages from reaching their intended target devices disrupting processes, operations, and causing cyber-physical impacts.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)  \n\nAdversaries may block communications by either making modifications to software ([System Firmware](https://attack.mitre.org/techniques/T0857), [Module Firmware](https://attack.mitre.org/techniques/T0839), [Hooking](https://attack.mitre.org/techniques/T0874), and [Rootkit](https://attack.mitre.org/techniques/T0851)) and services ([Service Stop](https://attack.mitre.org/techniques/T0881), [Denial of Service](https://attack.mitre.org/techniques/T0814)) on systems and devices or by positioning themselves between systems and devices and intercepting and blocking the communications such as the case with an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "inhibit-response-function"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0889",
                    "external_id": "T0889"
                },
                {
                    "source_name": "IEC February 2013",
                    "description": "IEC 2013, February 20 IEC 61131-3:2013  Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 ",
                    "url": "https://webstore.iec.ch/publication/4552"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:48.701Z",
            "name": "Modify Program",
            "description": "Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. \n\nProgram modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU)  (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. \n\nSome programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "persistence"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_version": "1.2"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "created": "2023-09-28T15:13:07.950Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0011",
                    "external_id": "A0011"
                },
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Virtual Private Network (VPN) Server",
            "description": "A VPN server is a device that is used to establish a secure network tunnel between itself and other remote VPN devices, including field VPNs. VPN servers can be used to establish a secure connection with a single remote device, or to securely bridge all traffic between two separate networks together by encapsulating all data between those networks. VPN servers typically support remote network services that are used by field VPNs to initiate the establishment of the secure VPN tunnel between the field device and server.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Virtual Private Network (VPN) terminator",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A VPN terminator is a device performs the role of either a VPN client or server to support the establishment of VPN connection. (Citation: IEC February 2019)"
                },
                {
                    "name": "Field VPN",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Field VPN are typically deployed at remote outstations and are used to create secure connections to VPN servers within data/control center environments.  "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "created": "2023-09-28T17:52:53.206Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0012",
                    "external_id": "A0012"
                },
                {
                    "source_name": "North American Electric Reliability Corporation June 2021",
                    "description": "North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 ",
                    "url": "https://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Jump Host",
            "description": "Jump hosts are devices used to support remote management sessions into ICS networks or devices. The system is used to access the ICS environment securely from external networks, such as the corporate network. The user must first remote into the jump host before they can access ICS devices. The jump host may be a customized Windows server using common remote access protocols (e.g., RDP) or a dedicated access management device. The jump host typically performs various security functions to ensure the authenticity of remote sessions, including authentication, enforcing access controls/permissions, and auditing all access attempts.  ",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Intermediate System",
                    "related_asset_sectors": [
                        "Electric"
                    ],
                    "description": "A Cyber Asset or collection of Cyber Assets performing access control to restrict Interactive Remote Access to only authorized users.(Citation: North American Electric Reliability Corporation June 2021)"
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "created": "2023-09-28T14:44:54.756Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0004",
                    "external_id": "A0004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Remote Terminal Unit (RTU)",
            "description": "A Remote Terminal Unit (RTU) is a device that typically resides between field devices (e.g., PLCs, IEDs) and control/SCADA servers and supports various communication interfacing and data aggregation functions. RTUs are typically responsible for forwarding commands from the control server and the collection of telemetry, events, and alerts from the field devices. An RTU can be implemented as a dedicated embedded device, as software platform that runs on a hardened/ruggedized computer, or using a custom application program on a PLC.",
            "x_mitre_sectors": [
                "Electric",
                "General",
                "Water and Wastewater"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "created": "2023-09-28T17:57:22.946Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0013",
                    "external_id": "A0013"
                },
                {
                    "source_name": "Guidance - NIST SP800-82",
                    "description": "Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Field I/O",
            "description": "Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.(Citation: Guidance - NIST SP800-82) These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes. ",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Smart Sensors",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "*A device that procures a voltage or current output that is representative of some physical property being measured (e.g., speed, temperature, flow).* (Citation: Guidance - NIST SP800-82) Smart sensors take this functionality and add on on-device processing and network communication."
                },
                {
                    "name": "Variable Frequency Drive (VFD)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "*A type of drive that controls the speed, but not the precise position, of a non-servo, AC motor by varying the frequency of the electricity going to that motor. VFDs are typically used for applications where speed and power are important, but precise positioning is not.* (Citation: Guidance - NIST SP800-82) VFDs can be network connected."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "created": "2023-09-28T14:38:54.407Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0002",
                    "external_id": "A0002"
                },
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Human-Machine Interface (HMI)",
            "description": "Human-Machine Interfaces (HMIs) are systems used by an operator to monitor the real-time status of an operational process and to perform necessary control functions, including the adjustment of device parameters. An HMI can take various forms, including a dedicated screen or control panel integrated with a specific device/controller, or a customizable software GUI application running on a standard operating system (e.g., MS Windows) that interfaces with a control/SCADA server. The HMI is critical to ensuring operators have sufficient visibility and control over the operational process.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Operator Workstation (OWS)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "An Operator Workstation (OWS) or Console is a system or device used by an operator to interface with a control system, including to access/visualizes key information or parameters about the operational process and initiate control actions. This typically consists of specialized OWS software installed on a Workstation platform. (Citation: IEC February 2019)"
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "created": "2025-09-29T18:56:19.712Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0018",
                    "external_id": "A0018"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Programmable Automation Controller (PAC)",
            "description": "A Programmable Automation Controller (PAC) is an embedded programmable control device. PACs are designed to enable automation applications across integrated software applications, peer controllers (e.g., PLC), Human Machine Interfaces, and other systems. PACs often include advanced features for process control, motion control, drive control, and vision applications. PACs are programmed using traditional process automation programming languages (IEC-61131) and sometimes languages such as C and C++ to support more advanced controls.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Field Device / Controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Programmable Automation Controller (PAC) may be referred to as Field Controllers or Field Devices as a general function name."
                },
                {
                    "name": "Programmable Logic Controller (PLC)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Programmable Logic Controllers (PLC) share some of the same functionality as PACs, although often without more advanced control features. Historically, differences between PLCs and PACs were minimal, resulting in varying use of the terms across industry. "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "created": "2023-09-28T15:01:48.509Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0009",
                    "external_id": "A0009"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T16:52:01.660Z",
            "name": "Data Gateway",
            "description": "Data Gateway is a device that supports the communication and exchange of data between different systems, networks, or protocols within the ICS. Different types of data gateways are used to perform various functions, including:\n\n *  <u>Protocol Translation:</u> Enable communication to devices that support different or incompatible protocols by translating information from one protocol to another. \n *  <u>Media Converter:</u> Convert data across different Layer 1 and 2 network protocols / mediums, for example, converting from Serial to Ethernet. \n *  <u>Data Aggregation:</u> Collect and combine data from different devices into one consistent format and protocol interface. \n*  <u>Data Mirroring:</u> Create a real-time, exact copy of data streams from devices to a separate destination for redundancy, monitoring, or backup purposes.\n\nData gateways are often critical to the forwarding/transmission of critical control or monitoring data within the ICS. Further, these devices often have remote various network services that are used to communicate across different zones or networks.  \n\nThese assets may focus on a single function listed below or combinations of these functions to best fit the industry use-case. \n",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Data Acquisition Server (DAS)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A Data Acquisition Server (DAS) a system or software platform that is used to collect, aggregate, and store data/telemetry from field devices using various SCADA/Automation protocols. "
                },
                {
                    "name": "Serial to Ethernet Gateway",
                    "related_asset_sectors": [
                        "Electric",
                        "General"
                    ],
                    "description": "A Serial to Ethernet gateway is a device that is used to connect field devices that only support serial-based communication (e.g., RS-232) with more modern Ethernet-based networks. "
                },
                {
                    "name": "Industrial Edge",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Devices that may house a cellular or other type of communication stack that is outside the normal network path. May be bi-directional access by outside parties or unidirectional by design to allow for feeding of data to outside areas such as corporate, vendor, or cloud."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "Linux",
                "Embedded",
                "Network Devices"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "created": "2023-09-28T15:10:05.534Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0010",
                    "external_id": "A0010"
                },
                {
                    "source_name": "Guidance - NIST SP800-82",
                    "description": "Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "SIGTTO ESD 2021",
                    "description": "Society of International Gas Tanker & Terminal Operators Ltd. (2021). ESD Systems: Recommendations for Emergency Shutdown and Related Safety Systems (Second Edition). Retrieved September 28, 2023.",
                    "url": "https://sigtto.org/media/3457/sigtto-2021-esd-systems.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Safety Controller",
            "description": "Safety controllers are typically a type of field device used to perform the safety critical function. Safety controllers often support the deployment of custom programs/logic, similar to a PLC, but can also be tailored for sector specific functions/applications. The safety controllers typically utilize redundant hardware and processors to ensure they operate reliably if a component fails.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Safety Instrumented System (SIS) controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "SIS controllers are used to “take the process to a safe state when predetermined conditions are violated” (Citation: Guidance - NIST SP800-82) through the reading of sensor data and interaction with digital/physical control surfaces. These devices are oftentimes located on programmable embedded devices running specialized RTOS or other embedded operating systems. "
                },
                {
                    "name": "Emergency Shutdown Systems (ESD) controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Emergency Shutdown System controllers are used to read sensor values and interact with control surfaces to return the system “to a safe static condition so that any remedial action can be taken”. (Citation: SIGTTO ESD 2021)"
                },
                {
                    "name": "Burner Management Systems (BMS) controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Burner Management System controllers are used to interact with sensors and control surfaces to maintain safe operating conditions for the burner. These can include safely starting-up and managing the main flame, controlling and monitoring the burning conditions, and safely initiating planned or unplanned shutdown sequences."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "created": "2023-09-28T14:46:42.566Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0005",
                    "external_id": "A0005"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Intelligent Electronic Device (IED)",
            "description": "An Intelligent Electronic Device (IED) is a type of specialized field device that is designed to perform specific operational functions, frequently for protection, monitoring, or control within the electric sector. IEDs are typically used to both acquire telemetry and execute tailored control algorithms/actions based on customizable parameters/settings. An IED is usually implemented as a dedicated embedded device and supports various network automation protocols to communicate with RTUs and Control Servers.",
            "x_mitre_sectors": [
                "Electric"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Protection Relay",
                    "related_asset_sectors": [
                        "Electric"
                    ],
                    "description": "A protection relay is a type of IED used within the electric sector to monitor for faults or problematic operating conditions on power lines, busses, or transformers. While traditionally protection relays were electromechanical or electromagnetic devices, modern relays utilize microprocessors, embedded operating system, and SCADA communications."
                },
                {
                    "name": "Field Device / Controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "IEDs may be referred to as Field Controllers or Field Devices as a general function name. "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "created": "2025-09-24T22:53:09.627Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0017",
                    "external_id": "A0017"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Distributed Control System (DCS) Controller",
            "description": "A Distributed Control System (DCS) Controller is a microprocessor unit that is used to manage automation processes. DCS Controllers are often found in plants (chemical, manufacturing, oil and gas, etc.) where large scale continuous automation processes are required. A DCS Controller typically operates as part of a larger networked system with other DCS Controllers where each DCS Controller manages an individual part of a continuous process. In addition to these other controllers, DCS Controllers operate along side multiple other system components including system software, operator stations, and other embedded field controllers. The distributed nature of DCS Controllers provides scalability, redundancy, and improved process reliability. DCS Controllers are programmed using traditional process automation programming languages (IEC-61131). ",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Field Device / Controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Distributed Control System (DCS) Controller may be referred to as Field Controllers or Field Devices as a general function name."
                },
                {
                    "name": "Programmable Logic Controller (PLC)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Programmable Logic Controllers (PLC) share some of the same functionality as DCS Controllers, although often without more advanced control features. "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "created": "2023-09-28T14:58:00.982Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0008",
                    "external_id": "A0008"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Application Server",
            "description": "Application servers are used across many different sectors to host various diverse software applications necessary to supporting the ICS. Example functions can include data analytics and reporting, alarm management, and the management/coordination of different control servers.  The application server typically runs on a modern server operating system (e.g., MS Windows Server).",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "File Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Server designed to house files within the ICS environment and/or securely transfer files between the ICS and enterprise networks."
                },
                {
                    "name": "License Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Vendor-specific server that operates and maintains application licenses for different ICS applications to prevent computers from reaching across the ICS/enterprise network boundary directly."
                },
                {
                    "name": "Update / Patch Management Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Server capable of providing updates and/or patches to computers with general purpose operating systems (e.g. MS Windows or Linux) within the ICS environment to prevent computers from reaching across the ICS/enterprise network boundary directly."
                },
                {
                    "name": "Domain Controller (DC)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "MS Windows server used for enforcing security policies and role-based access control (RBAC) rules and managing identity and access management (IAM) policies within a network."
                },
                {
                    "name": "Database Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "MS Windows (primarily) server used for tracking long-term point information, control sheets, license information, trends, etc.  Paired with a Domain Controller and in some cases may be installed on the same machine functioning as a domain controller. MS SQL & Oracle are common types of database software found. "
                },
                {
                    "name": "Alarm Collector",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Server that is a target of device/server alarms for a distributed system.  Some workstations or servers may have the job as the alarm collector and may only be a process/service running on the machine. "
                },
                {
                    "name": "Asset Management Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A vendor-specific piece of software that collects information about vendor hardware or allows for configuration of that hardware (i.e., FactoryTalk Asset Center).  May also be known as: Field Device Management. "
                },
                {
                    "name": "Telemetry Server",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Servers that collect Layer 2 communications or information and send via Layer 3 to other network segments or outside the control zone for collection (examples: PI Feeder, Remote Data Server).  "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "created": "2023-09-28T14:43:05.105Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0003",
                    "external_id": "A0003"
                },
                {
                    "source_name": "IEC February 2013",
                    "description": "IEC 2013, February 20 IEC 61131-3:2013  Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 ",
                    "url": "https://webstore.iec.ch/publication/4552"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Programmable Logic Controller (PLC)",
            "description": "A Programmable Logic Controller (PLC) is an embedded programmable control device. PLCs typically utilize a modular architecture with separate modules used to support its processing capabilities, communication mediums, and I/O interfaces. PLCs allow for the deployment of customized programs/logic to control or monitor an operational process. This logic is defined using industry specific programming languages, such as IEC 61131 (Citation: IEC February 2013), which define the set of tasks and program organizational units (POUs) included in the device’s programs.  PLCs also typically have distinct operating modes (e.g., Remote, Run, Program, Stop) which are used to determine when the device can be programmed or whether it should execute the custom logic.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Process Automation Controller  (PAC)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Process Automation Controllers (PAC) share much of the same functionality as a PLC. PACs may include advanced features for process control, motion control, drive control, and vision applications. PACs may include additional features such as options to program in traditional programming languages such as C and C++ in addition to 61131 programming languages in order to support these more advanced controls.  "
                },
                {
                    "name": "Field Device / Controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "Programmable Logic Controller (PLC) may be referred to as Field Controllers or Field Devices as a general function name.   "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "created": "2025-09-24T18:17:26.575Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0016",
                    "external_id": "A0016"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T16:51:34.368Z",
            "name": "Firewall",
            "description": "A gateway that limits access between networks in accordance with local security policy.\n\nIn ICS networks, firewalls can exist in multiple locations in the network architecture and  serve a variety of purposes. The first, and often the most important, is the firewall segmenting the ICS network from the business network. This firewall acts as the primary network boundary point that controls the ingress/egress of network traffic between the ICS and business networks. This firewall may also be a single device connected to multiple network segments, where the firewall defines individual zones for the different network segments and can control access to the zones and between the zones. This can limit the ability of an adversary to traverse a network.\n",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Boundary Firewall",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A boundary firewall is used to control the flow of traffic between two different networks. It is typically used to delineate the different levels of the Purdue Model. "
                },
                {
                    "name": "Device Firewall",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A device firewall is used to control the flow of traffic between a network and an individual device. It is used when additional protections are required beyond that of a boundary firewall. For example, a boundary firewall may limit traffic on the network to two protocols, but, a device firewall may further limit traffic to a particular device on that network to a single protocol."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Windows",
                "Linux",
                "Network Devices"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "created": "2025-09-24T17:53:28.482Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0015",
                    "external_id": "A0015"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T16:51:10.478Z",
            "name": "Switch",
            "description": "A switch is a network device that connects endpoints (e.g., workstations, servers, HMIs, PLCs, etc.) so that they can communicate and share data and resources. Switches may operate at either Layer 2 or Layer 3 of the OSI Model and intelligently forward packets across the network based on the specified address (Media Access Control (MAC) address for Layer 2 and Internet Protocol (IP) address for Layer 3). Switches are typically used to define network segments and connect the devices within a particular level of the Purdue Model.  ",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Core Switch",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A core switch is a device that provides high-speed and reliable connectivity and can be connected with other core switches to make up the backbone of large enterprise/ICS networks. "
                },
                {
                    "name": "Access Switch",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "An access switch is a device that allows end users via endpoints (e.g., workstations, servers, etc.) to connect to the network and share data and resources."
                },
                {
                    "name": "Layer 2 Switch",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A Layer 2 switch is a device that forwards data packets on the network based on the specified destination MAC address."
                },
                {
                    "name": "Layer 3 Switch",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A Layer 3 switch is a device that forwards data packets on the network based on the specified source and destination IP addresses."
                },
                {
                    "name": "Distribution Switch",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A distribution switch is a device that connects access switches with core switches and is responsible for controlling traffic between networks."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Network Devices"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "created": "2023-09-29T18:55:09.319Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0014",
                    "external_id": "A0014"
                },
                {
                    "source_name": "IETF RFC4949 2007",
                    "description": "Internet Engineering Task Force. (2007, August). Internet Security Glossary, Version 2. Retrieved September 29, 2023.",
                    "url": "https://www.ietf.org/rfc/rfc4949.txt"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T16:50:45.686Z",
            "name": "Routers",
            "description": "A computer that is a gateway between two networks at OSI layer 3 and that relays and directs data packets through that inter-network. The most common form of router operates on IP packets.(Citation: IETF RFC4949 2007)",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Network Devices"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "created": "2023-09-28T14:48:36.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0006",
                    "external_id": "A0006"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Data Historian",
            "description": "Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network. Many data historian vendors have designed their software to securely transfer data between the ICS and business networks instead of requiring business systems to access the data historian in the ICS network directly.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "created": "2023-09-28T14:55:39.339Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0007",
                    "external_id": "A0007"
                },
                {
                    "source_name": "Guidance - NIST SP800-82",
                    "description": "Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Control Server",
            "description": "Control servers are typically a software platform that runs on a modern server operating system (e.g., MS Windows Server). The server typically uses one or more automation protocols (e.g., Modbus, DNP3) to communicate with the various low-level control devices such as Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs). The control server also usually provides an interface/network service to connect with an HMI.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Supervisory Control And Data Acquisition (SCADA) Server",
                    "related_asset_sectors": [
                        "General",
                        "Electric",
                        "Water and Wastewater"
                    ],
                    "description": "A SCADA server is used to perform monitoring and control across a distributed environment. It typically has an associated HMI to provide information to a human operator and heavily depends on the human operator to initiate control actions."
                },
                {
                    "name": "Master Terminal Unit (MTU)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "*A controller that also acts as a server that hosts the control software that communicates with lower-level control devices, such as remote terminal units (RTUs) and programmable logic controllers (PLCs), over an ICS network* (Citation: Guidance - NIST SP800-82)"
                },
                {
                    "name": "Supervisory Controller",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "*A controller that also acts as a server that hosts the control software that communicates with lower-level control devices, such as remote terminal units (RTUs) and programmable logic controllers (PLCs), over an ICS network* (Citation: Guidance - NIST SP800-82)"
                },
                {
                    "name": "Distribution/Energy Management System (DMS/EMS)",
                    "related_asset_sectors": [
                        "Electric"
                    ],
                    "description": "A DMS and EMS are electric sector-specific systems that are commonly used to manage distribution and transmission-level electrical grids. These systems typically integrate a SCADA server and HMI with domain-specific data analysis applications, such as state-estimation and contingency analysis (EMS), or voltage-var control or fault restoration (DMS). These systems also maintain visibility (and in some cases control) through a variety of integrated and distributed automation systems. "
                },
                {
                    "name": "Building Management / Automation System (BMS / BAS)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "A controller (or set of controllers) that manages functionality for many common commercial / industrial buildings, such as heating, ventilation, and air conditioning (HVAC), lighting, elevators, etc."
                },
                {
                    "name": "Manufacturing Execution System (MES)",
                    "related_asset_sectors": [
                        "Manufacturing"
                    ],
                    "description": "A controller that oversees the performance, efficiency, life cycle, and resourcing for a manufacturing process within the ICS environment at a facility. A MES may interact with an Enterprise Resource Planning (ERP) system in the business environment to coordinate resourcing and job planning."
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Embedded",
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-asset",
            "spec_version": "2.1",
            "id": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "created": "2023-09-28T14:22:49.837Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/assets/A0001",
                    "external_id": "A0001"
                },
                {
                    "source_name": "North American Electric Reliability Corporation June 2021",
                    "description": "North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 ",
                    "url": "https://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.768Z",
            "name": "Workstation",
            "description": "Workstations are devices used by human operators or engineers to perform various configuration, programming, maintenance, diagnostic, or operational tasks. Workstations typically utilize standard desktop or laptop hardware and operating systems (e.g., MS Windows), but run dedicated control system applications or diagnostic/management software     to support interfacing with the control servers or field devices. Some workstations have a fixed location within the network architecture, while others are transient devices that are directly connected to various field devices to support local management activities.",
            "x_mitre_sectors": [
                "General"
            ],
            "x_mitre_related_assets": [
                {
                    "name": "Transient Cyber Asset (TCA)",
                    "related_asset_sectors": [
                        "Electric"
                    ],
                    "description": "A Transient Cyber Asset (TCA)(Citation: North American Electric Reliability Corporation June 2021) is a mobile workstation that is used to support management functions across multiple different networks, rather than being dedicated to any specific device/network. The TCA is often used to directly manage ICS environments that do not have any dedicated support for external remote access. Therefore, the TCA provides a mechanism for connectivity and file transfer to many networks/devices, even if they are segmented or “air gapped” from other networks.  "
                },
                {
                    "name": "Engineering Workstation (EWS)",
                    "related_asset_sectors": [
                        "General"
                    ],
                    "description": "An Engineering Workstation (EWS) is used to perform various maintenance, configuration, or diagnostics functions for a control system. The EWS will likely require dedicated application software to interface with various devices (e.g., RTUs, PLCs), and may be used to transfer data or files between the control system devices and other networks. "
                }
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-matrix",
            "spec_version": "2.1",
            "id": "x-mitre-matrix--575f48f4-8897-4468-897b-48bb364af6c7",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/matrices/ics",
                    "external_id": "ics-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:58.509Z",
            "name": "ATT&CK for ICS",
            "description": "Below are the tactics and techniques representing the MITRE ATT&CK Matrix for ICS.",
            "tactic_refs": [
                "x-mitre-tactic--69da72d2-f550-41c5-ab9e-e8255707f28a",
                "x-mitre-tactic--93bf9a8e-b14c-4587-b6d5-9efc7c12eb45",
                "x-mitre-tactic--78f1d2ae-a579-44c4-8fc5-3e1775c73fac",
                "x-mitre-tactic--33752ae7-f875-4f43-bdb6-d8d02d341046",
                "x-mitre-tactic--ddf70682-f3ce-479c-a9a4-7eadf9bfead7",
                "x-mitre-tactic--696af733-728e-49d7-8261-75fdc590f453",
                "x-mitre-tactic--51c25a9e-8615-40c0-8afd-1da578847924",
                "x-mitre-tactic--b2a67b1e-913c-46f6-b219-048a90560bb9",
                "x-mitre-tactic--97c8ff73-bd14-4b6c-ac32-3d91d2c41e3f",
                "x-mitre-tactic--298fe907-7931-4fd2-8131-2814dd493134",
                "x-mitre-tactic--ff048b6c-b872-4218-b68c-3735ebd1f024",
                "x-mitre-tactic--77542f83-70d0-40c2-8a9d-ad2eb8b00279"
            ],
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--298fe907-7931-4fd2-8131-2814dd493134",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0107",
                    "external_id": "TA0107"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:21.065Z",
            "name": "Inhibit Response Function",
            "description": "The adversary is trying to prevent your safety, protection, quality assurance, and operator intervention functions from responding to a failure, hazard, or unsafe state.\n\nInhibit Response Function consists of techniques that adversaries use to hinder the safeguards put in place for processes and products. This may involve the inhibition of safety, protection, quality assurance, or operator intervention functions to disrupt safeguards that aim to prevent the loss of life, destruction of equipment, and disruption of production. These techniques aim to actively deter and prevent expected alarms and responses that arise due to statuses in the ICS environment. Adversaries may modify or update system logic, or even outright prevent responses with a denial-of-service. They may result in the prevention, destruction, manipulation, or modification of programs, logic, devices, and communications. As prevention functions are generally dormant, reporting and processing functions can appear fine, but may have been altered to prevent failure responses in dangerous scenarios. Unlike [Evasion](https://attack.mitre.org/tactics/TA0103), Inhibit Response Function techniques may be more intrusive, such as actively preventing responses to a known dangerous scenario. Adversaries may use these techniques to follow through with or provide cover for [Impact](https://attack.mitre.org/tactics/TA0105) techniques.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "inhibit-response-function"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--33752ae7-f875-4f43-bdb6-d8d02d341046",
            "created": "2021-04-10T17:32:33.899Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0111",
                    "external_id": "TA0111"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:21.215Z",
            "name": "Privilege Escalation",
            "description": "The adversary is trying to gain higher-level permissions.\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "privilege-escalation"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--51c25a9e-8615-40c0-8afd-1da578847924",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0109",
                    "external_id": "TA0109"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:21.394Z",
            "name": "Lateral Movement",
            "description": "The adversary is trying to move through your ICS environment.\n\nLateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. These techniques abuse default credentials, known accounts, and vulnerable services, and may also leverage dual-homed devices and systems that reside on both the IT and OT networks. The adversary uses these techniques to pivot to their next point in the environment, positioning themselves to where they want to be or think they should be. Following through on their primary objective often requires [Discovery](https://attack.mitre.org/tactics/TA0102) of the network and [Collection](https://attack.mitre.org/tactics/TA0100) to develop awareness of unique ICS devices and processes, in order to find their target and subsequently gain access to it. Reaching this objective often involves pivoting through multiple systems, devices, and accounts. Adversaries may install their own remote tools to accomplish Lateral Movement or leverage default tools, programs, and manufacturer set or other legitimate credentials native to the network, which may be stealthier.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "lateral-movement"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--696af733-728e-49d7-8261-75fdc590f453",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0102",
                    "external_id": "TA0102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:28.358Z",
            "name": "Discovery",
            "description": "The adversary is locating information to assess and identify their targets in your environment.\n\nDiscovery consists of techniques that adversaries use to survey your ICS environment and gain knowledge about the internal network, control system devices, and how their processes interact. These techniques help adversaries observe the environment and determine next steps for target selection and Lateral Movement. They also allow adversaries to explore what they can control and gain insight on interactions between various control system processes. Discovery techniques are often an act of progression into the environment which enable the adversary to orient themselves before deciding how to act. Adversaries may use Discovery techniques that result in Collection, to help determine how available resources benefit their current objective. A combination of native device communications and functions, and custom tools are often used toward this post-compromise information-gathering objective.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "discovery"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--69da72d2-f550-41c5-ab9e-e8255707f28a",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0108",
                    "external_id": "TA0108"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:28.727Z",
            "name": "Initial Access",
            "description": "The adversary is trying to get into your ICS environment.\n\nInitial Access consists of techniques that adversaries may use as entry vectors to gain an initial foothold within an ICS environment. These techniques include compromising operational technology assets, IT resources in the OT network, and external remote services and websites. They may also target third party entities and users with privileged access. In particular, these initial access footholds may include devices and communication mechanisms with access to and privileges in both the IT and OT environments. IT resources in the OT environment are also potentially vulnerable to the same attacks as enterprise IT systems. Trusted third parties of concern may include vendors, maintenance personnel, engineers, external integrators, and other outside entities involved in expected ICS operations. Vendor maintained assets may include physical devices, software, and operational equipment. Initial access techniques may also leverage outside devices, such as radios, controllers, or removable media, to remotely interfere with and possibly infect OT operations.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "initial-access"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--77542f83-70d0-40c2-8a9d-ad2eb8b00279",
            "created": "2019-03-14T18:44:44.639Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0105",
                    "external_id": "TA0105"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:21.936Z",
            "name": "Impact",
            "description": "The adversary is trying to manipulate, interrupt, or destroy your ICS systems, data, and their surrounding environment.\n\nImpact consists of techniques that adversaries use to disrupt, compromise, destroy, and manipulate the integrity and availability of control system operations, processes, devices, and data. These techniques encompass the influence and effects resulting from adversarial efforts to attack the ICS environment or that tangentially impact it. Impact techniques can result in more instantaneous disruption to control processes and the operator, or may result in more long term damage or loss to the ICS environment and related operations. The adversary may leverage [Impair Process Control](https://attack.mitre.org/tactics/TA0106) techniques, which often manifest in more self-revealing impacts on operations, or [Impair Process Control](https://attack.mitre.org/tactics/TA0106) techniques to hinder safeguards and alarms in order to follow through with and provide cover for Impact. In some scenarios, control system processes can appear to function as expected, but may have been altered to benefit the adversary’s goal over the course of a longer duration. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.\n\n[Loss of Productivity and Revenue](https://attack.mitre.org/techniques/T0828), [Theft of Operational Information](https://attack.mitre.org/techniques/T0882), and [Damage to Property](https://attack.mitre.org/techniques/T0879) are meant to encompass some of the more granular goals of adversaries in targeted and untargeted attacks. These techniques in and of themselves are not necessarily detectable, but the associated adversary behavior can potentially be mitigated and/or detected.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "impact"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--78f1d2ae-a579-44c4-8fc5-3e1775c73fac",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0110",
                    "external_id": "TA0110"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:29.269Z",
            "name": "Persistence",
            "description": "The adversary is trying to maintain their foothold in your ICS environment.\n\nPersistence consists of techniques that adversaries use to maintain access to ICS systems and devices across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that allow them to secure their ongoing activity and keep their foothold on systems. This may include replacing or hijacking legitimate code, firmware, and other project files, or adding startup code and downloading programs onto devices.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "persistence"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--93bf9a8e-b14c-4587-b6d5-9efc7c12eb45",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0104",
                    "external_id": "TA0104"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:22.274Z",
            "name": "Execution",
            "description": "The adversary is trying to run code or manipulate system functions, parameters, and data in an unauthorized way.\n\nExecution consists of techniques that result in adversary-controlled code running on a local or remote system, device, or other asset. This execution may also rely on unknowing end users or the manipulation of device operating modes to run. Adversaries may infect remote targets with programmed executables or malicious project files that operate according to specified behavior and may alter expected device behavior in subtle ways. Commands for execution may also be issued from command-line interfaces, APIs, GUIs, or other available interfaces. Techniques that run malicious code may also be paired with techniques from other tactics, particularly to aid network [Discovery](https://attack.mitre.org/tactics/TA0102) and [Collection](https://attack.mitre.org/tactics/TA0100), impact operations, and inhibit response functions.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "execution"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--97c8ff73-bd14-4b6c-ac32-3d91d2c41e3f",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0101",
                    "external_id": "TA0101"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:29.812Z",
            "name": "Command and Control",
            "description": "The adversary is trying to communicate with and control compromised systems, controllers, and platforms with access to your ICS environment.\n\nCommand and Control consists of techniques that adversaries use to communicate with and send commands to compromised systems, devices, controllers, and platforms with specialized applications used in ICS environments. Examples of these specialized communication devices include human machine interfaces (HMIs), data historians, SCADA servers, and engineering workstations (EWS). Adversaries often seek to use commonly available resources and mimic expected network traffic to avoid detection and suspicion. For instance, commonly used ports and protocols in ICS environments, and even expected IT resources, depending on the target network. Command and Control may be established to varying degrees of stealth, often depending on the victim’s network structure and defenses.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "command-and-control"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--b2a67b1e-913c-46f6-b219-048a90560bb9",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0100",
                    "external_id": "TA0100"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:22.653Z",
            "name": "Collection",
            "description": "The adversary is trying to gather data of interest and domain knowledge on your ICS environment to inform their goal.\n\nCollection consists of techniques adversaries use to gather domain knowledge and obtain contextual feedback in an ICS environment. This tactic is often performed as part of [Discovery](https://attack.mitre.org/tactics/TA0102), to compile data on control systems and targets of interest that may be used to follow through on the adversary’s objective. Examples of these techniques include observing operation states, capturing screenshots, identifying unique device roles, and gathering system and diagram schematics. Collection of this data can play a key role in planning, executing, and even revising an ICS-targeted attack. Methods of collection depend on the categories of data being targeted, which can include protocol specific, device specific, and process specific configurations and functionality. Information collected may pertain to a combination of system, supervisory, device, and network related data, which conceptually fall under high, medium, and low levels of plan operations. For example, information repositories on plant data at a high level or device specific programs at a low level. Sensitive floor plans, vendor device manuals, and other references may also be at risk and exposed on the internet or otherwise publicly accessible.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "collection"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--ddf70682-f3ce-479c-a9a4-7eadf9bfead7",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0103",
                    "external_id": "TA0103"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-25T14:39:30.353Z",
            "name": "Evasion",
            "description": "The adversary is trying to avoid security defenses.\n\nEvasion consists of techniques that adversaries use to avoid technical defenses throughout their campaign. Techniques used for evasion include removal of indicators of compromise, spoofing communications, and exploiting software vulnerabilities. Adversaries may also leverage and abuse trusted devices and processes to hide their activity, possibly by masquerading as master devices or native software. Methods of defense evasion for this purpose are often more passive in nature.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "evasion"
        },
        {
            "type": "x-mitre-tactic",
            "spec_version": "2.1",
            "id": "x-mitre-tactic--ff048b6c-b872-4218-b68c-3735ebd1f024",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/tactics/TA0106",
                    "external_id": "TA0106"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-04-16T21:26:23.006Z",
            "name": "Impair Process Control",
            "description": "The adversary is trying to manipulate, disable, or damage physical control processes.\n\nImpair Process Control consists of techniques that adversaries use to disrupt control logic and cause determinantal effects to processes being controlled in the target environment. Targets of interest may include active procedures or parameters that manipulate the physical environment. These techniques can also include prevention or manipulation of reporting elements and control logic. If an adversary has modified process functionality, then they may also obfuscate the results, which are often self-revealing in their impact on the outcome of a product or the environment. The direct physical control these techniques exert may also threaten the safety of operators and downstream users, which can prompt response mechanisms. Adversaries may follow up with or use [Inhibit Response Function](https://attack.mitre.org/tactics/TA0107) techniques in tandem, to assist with the successful abuse of control processes to result in [Impact](https://attack.mitre.org/tactics/TA0105).",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_shortname": "impair-process-control"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "created": "2026-09-25T20:09:19.593Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/003",
                    "external_id": "T1701.003"
                },
                {
                    "source_name": "Apple ZShell",
                    "description": "Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.",
                    "url": "https://support.apple.com/HT208050"
                },
                {
                    "source_name": "DieNet Bash",
                    "description": "die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.",
                    "url": "https://linux.die.net/man/1/bash"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:34:55.625Z",
            "name": "Unix Shell",
            "description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [Remote Services](https://attack.mitre.org/techniques/T0886). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.\n\nWithin Industrial control system networks, workstations, control servers, hypervisors, networking devices, and embedded devices that run on linux platforms may allow for Unix command shell access or stripped-down shells to implement a subset of commands. Industrial automation equipment generally does not offer command shells as a native user interface.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "created": "2026-10-07T17:39:30.711Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/006",
                    "external_id": "T1701.006"
                },
                {
                    "source_name": "Microsoft JScript 2007",
                    "description": "Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020.",
                    "url": "https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript"
                },
                {
                    "source_name": "Microsoft Windows Scripts",
                    "description": "Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020.",
                    "url": "https://docs.microsoft.com/scripting/winscript/windows-script-interfaces"
                },
                {
                    "source_name": "JScrip May 2018",
                    "description": "Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020.",
                    "url": "https://docs.microsoft.com/windows/win32/com/translating-to-jscript"
                },
                {
                    "source_name": "NodeJS",
                    "description": "OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020.",
                    "url": "https://nodejs.org/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:17:19.764Z",
            "name": "JavaScript",
            "description": "Adversaries may abuse various implementations of JavaScript for execution. JavaScript is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JavaScript can be executed in runtime environments outside the browser.(Citation: NodeJS)\n\nJScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)\n\nAdversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T0817) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).\n\nWithin industrial control system networks, adversaries most commonly abuse the use of JavaScript on overlap assets that run on operating system platforms similar to Enterprise devices. \n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "created": "2026-09-26T01:52:11.220Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/005",
                    "external_id": "T1701.005"
                },
                {
                    "source_name": "Zscaler APT31 Covid-19 October 2020",
                    "description": "Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.",
                    "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:24:33.641Z",
            "name": "Python",
            "description": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)\n\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Within industrial control system environments, Python libraries have been developed to implement multiple ICS protocols to establish communications with field devices. Adversaries can use these libraries or develop their own to execute commands on workstation, control server assets or send remote command messages to manipulate the industrial process through exisiting ICS protocols. \n\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "created": "2026-09-26T03:33:15.757Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0869/002",
                    "external_id": "T0869.002"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:51:02.824Z",
            "name": "Publish/Subscribe Protocols",
            "description": "Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and broker.\n\nProtocols such as MQTT are widely used in Internet-of-Things (IoT) and operational technology environments where devices are resource constrained and there is limited or unreliable network bandwidth. The protocol follows a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also blending in with normal, expected traffic.\n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "command-and-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "created": "2026-09-25T16:36:36.601Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701",
                    "external_id": "T1701"
                },
                {
                    "source_name": "Remote Shell Execution in Python",
                    "description": "Abdou Rockikz. (2020, July). How to Execute Shell Commands in a Remote Machine in Python. Retrieved July 26, 2021.",
                    "url": "https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python"
                },
                {
                    "source_name": "Cisco IOS Software Integrity Assurance - Command History",
                    "description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020.",
                    "url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23"
                },
                {
                    "source_name": "Powershell Remote Commands",
                    "description": "Microsoft. (2020, August 21). Running Remote Commands. Retrieved July 26, 2021.",
                    "url": "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T16:56:53.660Z",
            "name": "Command and Scripting Interpreter",
            "description": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms within industrial control system environments. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1701/003) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1701/002) and [PowerShell](https://attack.mitre.org/techniques/T1701/001). Some also have cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1701/005), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1701/006) and [Visual Basic](https://attack.mitre.org/techniques/T1701/004). Many controllers have command-line interfaces for management purposes. \n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0108) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T0886) (e.g., Telnet, SSH, RDP, etc.) often found in industrial control system environments to achieve remote [Execution](https://attack.mitre.org/tactics/TA0104).(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "created": "2026-09-25T18:09:28.846Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/001",
                    "external_id": "T1701.001"
                },
                {
                    "source_name": "Microsoft PSfromCsharp APR 2014",
                    "description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.",
                    "url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
                },
                {
                    "source_name": "SilentBreak Offensive PS Dec 2015",
                    "description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.",
                    "url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
                },
                {
                    "source_name": "TechNet PowerShell",
                    "description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.",
                    "url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
                },
                {
                    "source_name": "Sixdub PowerPick Jan 2016",
                    "description": "Warner, J.. (2015, January 6). Inexorable PowerShell – A Red Teamer’s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.",
                    "url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T17:14:23.887Z",
            "name": "PowerShell",
            "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nPowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)\n\nWithin industrial control system networks, adversaries may abuse the use of PowerShell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "created": "2026-09-25T19:12:31.330Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/002",
                    "external_id": "T1701.002"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T17:29:41.220Z",
            "name": "Windows Command Shell",
            "description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems which is used in industrial control system environments. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via  [Remote Services](https://attack.mitre.org/techniques/T0886) (e.g., Telnet, SSH, RDP, etc.) \n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. \n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel. \n\nWithin industrial control system networks, adversaries may abuse the use of Windows Command Shell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.). ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "created": "2026-09-25T20:25:54.269Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1701/004",
                    "external_id": "T1701.004"
                },
                {
                    "source_name": "VB .NET Mar 2020",
                    "description": ".NET Team. (2020, March 11). Visual Basic support planned for .NET 5.0. Retrieved June 23, 2020.",
                    "url": "https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/"
                },
                {
                    "source_name": "Microsoft VBScript",
                    "description": "Microsoft. (2011, April 19). What Is VBScript?. Retrieved March 28, 2020.",
                    "url": "https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)"
                },
                {
                    "source_name": "Microsoft VBA",
                    "description": "Microsoft. (2019, June 11). Office VBA Reference. Retrieved June 23, 2020.",
                    "url": "https://docs.microsoft.com/office/vba/api/overview/"
                },
                {
                    "source_name": "VB Microsoft",
                    "description": "Microsoft. (n.d.). Visual Basic documentation. Retrieved June 23, 2020.",
                    "url": "https://docs.microsoft.com/dotnet/visual-basic/"
                },
                {
                    "source_name": "Wikipedia VBA",
                    "description": "Wikipedia. (n.d.). Visual Basic for Applications. Retrieved August 13, 2020.",
                    "url": "https://en.wikipedia.org/wiki/Visual_Basic_for_Applications"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T17:48:25.598Z",
            "name": "Visual Basic",
            "description": "Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)\n\nDerivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1701/006) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)\n\nAdversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).\n\nWithin industrial control system networks, adversaries may abuse the use of VB and VBScript on overlap assets that run on Microsoft Windows operating systems, especially in cases where legacy versions are still used in operations (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).  ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "created": "2026-09-26T02:55:07.994Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T0869/001",
                    "external_id": "T0869.001"
                },
                {
                    "source_name": "Medium DnsTunneling",
                    "description": "Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.",
                    "url": "https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"
                },
                {
                    "source_name": "OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government",
                    "description": "Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.",
                    "url": "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"
                },
                {
                    "source_name": "PAN DNS Tunneling",
                    "description": "Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.",
                    "url": "https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"
                },
                {
                    "source_name": "DNS Beacons",
                    "description": "Vercara. (n.d.). Retrieved July 21, 2025.",
                    "url": "https://vercara.digicert.com/resources/dns-beacons#page_top"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T18:14:56.779Z",
            "name": "DNS",
            "description": "Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\nThe DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)\n\nDNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government)\n DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.\n\nAdversaries may also use DNS over TLS (DoT) or HTTPS (DoH) for resolving C2 servers. This encrypts the DNS requests and allows the malware to lookup C2 servers without being detected by security systems (e.g., DNS filtering based on indicators of compromise). \n",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-ics-attack",
                    "phase_name": "command-and-control"
                }
            ],
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0"
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--0099659c-6a20-4331-9d47-b1c0c380fd6b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0749#AN1881",
                    "external_id": "AN1881"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:43.395Z",
            "name": "Analytic 1881",
            "description": "Monitor Windows Security Event ID 4663 on explicitly audited ICS data paths and correlate repeated ReadData/ListDirectory access across multiple sensitive files or directories by an account/process outside the approved engineering, backup, or application baseline. This requires Object Access auditing and SACLs on the monitored paths; Sysmon does not provide generic file-read telemetry. Alert when the bulk-read pattern occurs outside an approved backup/export window or is followed by staging, compression, or network transfer.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to perform legitimate bulk reads of ICS data."
                },
                {
                    "field": "BulkAccessThreshold",
                    "description": "Number of distinct files read within the detection window that constitutes bulk collection."
                },
                {
                    "field": "ICSDataPaths",
                    "description": "File system paths containing ICS configuration, project, and sensitive operational data."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--058d856a-6356-402f-b3ff-a7c1b6186921",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0804#AN1936",
                    "external_id": "AN1936"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:33.082Z",
            "name": "Analytic 1936",
            "description": "Real-time monitoring identifies a remote service connection between two Industrial Control System (ICS) network hosts that does not match the documented, approved communication matrix, where the destination host subsequently exhibits process execution or file access inconsistent with normal automated/scheduled inter-host communication. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Comprehensive matrix of expected inter-host communication on remote service ports."
                },
                {
                    "field": "ApprovedLateralMovementPairs",
                    "description": "Documented, approved host-to-host remote access pairs within the ICS network."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0722#AN1855",
                    "external_id": "AN1855"
                },
                {
                    "source_name": "EyeofRa Detecting Hooking June 2017",
                    "description": "Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense against user-land. Retrieved December 12, 2017.",
                    "url": "https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/"
                },
                {
                    "source_name": "Zairon Hooking Dec 2006",
                    "description": "Felici, M. (2006, December 6). Any application-defined hook procedure on my machine?. Retrieved December 12, 2017.",
                    "url": "https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/"
                },
                {
                    "source_name": "Microsoft Hook Overview",
                    "description": "Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.",
                    "url": "https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx"
                },
                {
                    "source_name": "PreKageo Winhook Jul 2011",
                    "description": "Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.",
                    "url": "https://github.com/prekageo/winhook"
                },
                {
                    "source_name": "Jay GetHooks Sept 2011",
                    "description": "Satiro, J. (2011, September 14). GetHooks. Retrieved December 12, 2017.",
                    "url": "https://github.com/jay/gethooks"
                },
                {
                    "source_name": "Volatility Detecting Hooks Sept 2012",
                    "description": "Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.",
                    "url": "https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:23.517Z",
            "name": "Analytic 1855",
            "description": "Real-time monitoring identifies an unsigned or unexpected process calling Windows hooking Application Programming Interfaces (APIs) (SetWindowsHookEx, SetWinEventHook) targeting an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) process, immediately followed by that target process loading a Dynamic Link Library (DLL) not present in the vendor's signed module baseline. Confirmed in the wild: Stuxnet replaced Siemens' s7otbxdx.dll on engineering workstations to intercept and falsify Programmable Logic Controller (PLC) read/write calls between WinCC/STEP7 and the controller. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "edr:ProcessIntegrity",
                    "channel": "Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedICSVendorProcessList",
                    "description": "Allowlist of processes permitted to install window/event hooks on ICS engineering and HMI hosts."
                },
                {
                    "field": "ICSServiceBinaryList",
                    "description": "List of binary paths for ICS gateway, OPC, and historian services on Linux assets that should never be launched with LD_PRELOAD set."
                },
                {
                    "field": "VendorPackageManifest",
                    "description": "Package manager manifest cross-reference confirming a shared library belongs to an installed, signed package."
                },
                {
                    "field": "VendorSignedDLLHashBaseline",
                    "description": "Cryptographic hash inventory of all vendor-signed ICS communication DLLs, refreshed on every legitimate vendor patch cycle."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--0b4e7cfa-9f9d-49b0-b5bf-afdf62058c5a",
            "created": "2026-04-22T22:55:44.526Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0912#AN2055",
                    "external_id": "AN2055"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:22.362Z",
            "name": "Analytic 2055",
            "description": "Real-time monitoring identifies wireless controller management log entries showing Service Set Identifier (SSID) or Media Access Control (MAC) address filter configuration changes for the Industrial Control System (ICS) wireless network from an account not in the authorized wireless admins. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "WinEventLog:Application",
                    "channel": "wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessAdminList",
                    "description": "Accounts/sources authorized to modify wireless infrastructure configuration."
                },
                {
                    "field": "DeauthTimeWindow",
                    "description": "Time window within which multiple deauthentication events are considered a coordinated mass event."
                },
                {
                    "field": "MassDeauthThreshold",
                    "description": "Number of simultaneously deauthenticated enrolled devices that constitutes a mass event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1017530e-423d-4857-80b6-99891bf82d28",
            "created": "2026-04-22T16:28:31.400Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0905#AN2048",
                    "external_id": "AN2048"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:34.740Z",
            "name": "Analytic 2048",
            "description": "Real-time monitoring identifies successful authentication to Windows-hosted Industrial Control System (ICS) applications using credentials matching known default or hardcoded vendor passwords. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                },
                {
                    "field": "KnownHardcodedCredentialPatterns",
                    "description": "Documented hardcoded credential values for in-use ICS products."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--11a350cf-1ea0-4065-877b-c3bb410bf3a0",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0784#AN1916",
                    "external_id": "AN1916"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:29.860Z",
            "name": "Analytic 1916",
            "description": "Real-time monitoring identifies the absence of expected command-message delivery confirmation -- a Supervisory Control and Data Acquisition (SCADA)-issued command that does not produce the expected corresponding state-change response within the normal response latency window, while the device remains reachable for other traffic. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "process value expected to change following a command does not change within command confirmation window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "scada:applog",
                    "channel": "command issued to device_ip with no corresponding state-change confirmation received within command confirmation window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommandConfirmationWindow",
                    "description": "Maximum expected latency between a command being issued and its corresponding state-change confirmation."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1672d2e3-8756-4380-b22c-517aa9f1cce0",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0754#AN1886",
                    "external_id": "AN1886"
                },
                {
                    "source_name": "Atlassian Confluence Logging",
                    "description": "Atlassian. (2018, January 9). How to Enable User Access Logging. Retrieved April 4, 2018.",
                    "url": "https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html"
                },
                {
                    "source_name": "Microsoft SharePoint Logging",
                    "description": "Microsoft. (2017, July 19). Configure audit settings for a site collection. Retrieved April 4, 2018.",
                    "url": "https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2"
                },
                {
                    "source_name": "Sharepoint Sharing Events",
                    "description": "Microsoft. (n.d.). Sharepoint Sharing Events. Retrieved October 8, 2021.",
                    "url": "https://docs.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide#sharepoint-sharing-events"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:26.194Z",
            "name": "Analytic 1886",
            "description": "Real-time monitoring identifies access to Industrial Control System (ICS) documentation repositories by an account or session context not associated with documented engineering roles, immediately followed by bulk file access or archive creation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa",
                    "name": "fileserver:audit",
                    "channel": "sequential access to above bulk document access threshold files within information repository time window from single session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "historian:applog",
                    "channel": "historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "AuthorizedEngineerAccounts",
                    "description": "Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories."
                },
                {
                    "field": "BulkDocumentAccessThreshold",
                    "description": "File count threshold distinguishing bulk reconnaissance from routine reference lookups."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Row count threshold for historian queries considered bulk export."
                },
                {
                    "field": "InformationRepositoryTimeWindow",
                    "description": "Time window within which sequential file accesses are considered part of a single bulk collection event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1be515a0-2656-4b35-a561-e8157169350d",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0727#AN1860",
                    "external_id": "AN1860"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:11.613Z",
            "name": "Analytic 1860",
            "description": "Real-time network monitoring identifies a source issuing read-only Industrial Control System (ICS) protocol requests to multiple field devices at a polling rate exceeding the legitimate Supervisory Control and Data Acquisition (SCADA) baseline, from a source not in the approved control server allowlist. Because the action is read-only, source-identity and rate deviation are the only available distinguishing signals. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to connect."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices."
                },
                {
                    "field": "BaselinePollRate",
                    "description": "Measured normal polling frequency per device, derived from actual baseline traffic capture."
                },
                {
                    "field": "KnownTagAddressRanges",
                    "description": "Documented register/tag address ranges that legitimate SCADA polling actually queries."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1e9c5d46-14e2-4efc-8861-e6dc942b3b9c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0763#AN1895",
                    "external_id": "AN1895"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1895",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2195ec67-7cea-4b0d-a678-18384089bf2c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0741#AN1874",
                    "external_id": "AN1874"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:04.902Z",
            "name": "Analytic 1874",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a controller's task/organization-block configuration from a source not in the approved engineering workstation list, correlated against post-modification cycle timing deviation. Documented precedent: Stuxnet infected Siemens OB1 (main execution cycle block) so its malicious payload ran every cycle, and infected OB35 (watchdog/interrupt block) to suppress error reporting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d",
                    "name": "assetinventory:ProgramDiff",
                    "channel": "current task-to-block assignment table differs from last known-good baseline without corresponding change ticket"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "task/organization-block modification service from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "device:VendorLog",
                    "channel": "measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BaselineCycleTime",
                    "description": "Measured normal scan cycle time for the specific controller and program."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which task reconfiguration is authorized."
                },
                {
                    "field": "CycleTimingDeviationThreshold",
                    "description": "Percentage or absolute deviation from baseline cycle time indicating a task reassignment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to modify controller task configuration."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--22b202f2-d4dd-44dd-b5e1-791ff2aef8ed",
            "created": "2026-04-23T00:42:36.732Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0915#AN2058",
                    "external_id": "AN2058"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:08.790Z",
            "name": "Analytic 2058",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) online-edit command sequence (incremental program modification while the device remains in RUN mode) from a source not in the approved engineering workstation list, outside a scheduled change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "online edit session logged without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which online edits are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform online edits."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2388dc31-ba9a-4c12-b4b9-28bbc981c73e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0726#AN1859",
                    "external_id": "AN1859"
                },
                {
                    "source_name": "Nzyme Alerts Intro",
                    "description": "Koopmann, Lennart. (n.d.). Nzyme Alerts Introduction. Retrieved November 17, 2024.",
                    "url": "https://docs.nzyme.org/wifi/monitoring/network-monitoring/"
                },
                {
                    "source_name": "Wireless Intrusion Detection",
                    "description": "Tomko, A.; Rieser, C; Buell, H.; Zeret, D.; Turner, W.. (2007, March). Wireless Intrusion Detection. Retrieved September 26, 2022.",
                    "url": "https://apps.dtic.mil/sti/pdfs/ADA466332.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:31.039Z",
            "name": "Analytic 1859",
            "description": "Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "wireless:radius",
                    "channel": "Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless monitor mode for diagnostics."
                },
                {
                    "field": "WirelessOnboardWindow",
                    "description": "Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--23ce0ac3-6afe-4647-be72-e1e9bcd1490e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0793#AN1925",
                    "external_id": "AN1925"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:53.370Z",
            "name": "Analytic 1925",
            "description": "Real-time monitoring identifies a trusted, signed Windows system binary executing with command-line arguments inconsistent with its documented administrative purpose -- specifically arguments indicating payload decoding, remote content execution, or script invocation -- on an Industrial Control System (ICS) host. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of ICS hosts warranting this elevated monitoring."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--23eb2bc3-735d-4425-96e1-f9d3a1453bfa",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0794#AN1926",
                    "external_id": "AN1926"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:18.931Z",
            "name": "Analytic 1926",
            "description": "Real-time monitoring identifies a Windows process generating Industrial Control System (ICS) command messages to field device tags representing physical outputs, from a process that is not the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, targeting safety-critical output tags. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate control sources."
                },
                {
                    "field": "RapidToggleWindow",
                    "description": "Time window within which multiple safety-critical output changes are considered a coordinated event."
                },
                {
                    "field": "SafetyCriticalOutputAddresses",
                    "description": "Documented register/IOA addresses corresponding to safety-critical outputs per device."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--28eb77c1-1834-4b7a-a06f-afebb7f2e756",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0800#AN1932",
                    "external_id": "AN1932"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:57.089Z",
            "name": "Analytic 1932",
            "description": "Real-time monitoring identifies a process loading a packet capture driver or executing a known capture utility on an Industrial Control System (ICS) host's network interface, from a process or account not associated with documented network analysis responsibilities. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode= 6 Npcap/WinPcap driver loaded by image not in authorized capture software"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 capture utility execution from account not in approved network analysts"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAnalysts",
                    "description": "Accounts with documented network analysis/diagnostic responsibilities."
                },
                {
                    "field": "AuthorizedCaptureSoftware",
                    "description": "Allowlist of approved packet capture tools and processes that legitimately load capture drivers."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--29b6e4b8-878c-4139-aa56-7e1513714d34",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0775#AN1907",
                    "external_id": "AN1907"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1907",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2b751a3d-c680-46c9-b92b-55a9d24bd4f9",
            "created": "2026-05-04T13:53:11.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0748#AN2066",
                    "external_id": "AN2066"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:01.245Z",
            "name": "Analytic 2066",
            "description": "Real-time monitoring identifies a field device loading a modified autorun image (boot read-only memory, bootloader firmware) detected by a discrepancy between the device's declared firmware hash and the authorized firmware inventory hash, with post-reboot device behavior diverging from expected (unexpected protocols active, unanticipated network connections). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "device firmware hash does not match authorized firmware inventory following a reboot event"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "NSM:Connections",
                    "channel": "device establishes new network connections or activates protocols not seen in pre-reboot baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSSoftwareInventory",
                    "description": "Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts."
                },
                {
                    "field": "AutorunModificationWindow",
                    "description": "Time window correlating removable media insertion with a subsequent autorun configuration change."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--302a5327-70cf-44b5-b592-ce9a62014dcc",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0735#AN1868",
                    "external_id": "AN1868"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1868",
            "description": "Monitor command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. \nMonitor log files for process execution through command-line and scripting activities. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages.\nMonitor contextual data about a running process, which may include information such as environment variables, image name, user/owner, or other information that may reveal abuse of system features. \nMonitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (e.g., JScript.dll, vbscript.dll).\nMonitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "Command",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "Module",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd",
                    "name": "Script",
                    "channel": "None"
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--322ac45b-d540-4d2a-84a1-cde200238b95",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0739#AN1872",
                    "external_id": "AN1872"
                },
                {
                    "source_name": "Elastic - Koadiac Detection with EQL",
                    "description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.",
                    "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:40.667Z",
            "name": "Analytic 1872",
            "description": "Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate engineering and SCADA systems."
                },
                {
                    "field": "AuthorizedNetworkTools",
                    "description": "Allowlist of network management/diagnostic tools authorized for use on ICS hosts."
                },
                {
                    "field": "DiscoveryTimeWindow",
                    "description": "Time window within which sequential connections across the address range are considered a single discovery sweep event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--32bfb2ab-2ad1-4c00-8428-96bc626c34f3",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0746#AN1879",
                    "external_id": "AN1879"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:15.236Z",
            "name": "Analytic 1879",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host injecting spoofed reporting messages into the Supervisory Control and Data Acquisition (SCADA) data path -- Open Platform Communications Unified Architecture (OPC UA) data change notifications with fabricated values, or historian tag writes that override device-sourced values -- from a process that is not the recognized data acquisition process. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170",
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SensorToleranceThreshold",
                    "description": "Acceptable divergence between primary and independent secondary measurement of the same physical quantity."
                },
                {
                    "field": "ZeroVarianceWindow",
                    "description": "Time window over which reported values are checked for implausible stability."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--32db74f9-d46d-4728-891a-113a8b8e2b07",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0782#AN1914",
                    "external_id": "AN1914"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:20.792Z",
            "name": "Analytic 1914",
            "description": "Real-time monitoring identifies a browser process on an Industrial Control System (ICS) workstation spawning an unexpected child process immediately following navigation to an external website, particularly a vendor support or software-download site. Documented Havex precedent: adversaries compromised legitimate ICS vendor websites to serve trojanized software downloads. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "webproxy:applog",
                    "channel": "file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of ICS engineering/operator workstations from which routine vendor software downloads occur."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--330166da-bc80-4aca-bd41-cbd6b1742812",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0777#AN1909",
                    "external_id": "AN1909"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:49.005Z",
            "name": "Analytic 1909",
            "description": "Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to alarm threshold Object Identifiers (OIDs) on Industrial Control System (ICS) network devices or process monitoring systems from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmThresholdAddressRange",
                    "description": "Register addresses specifically corresponding to alarm threshold/deadband configuration."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to modify alarm configuration."
                },
                {
                    "field": "SafeAlarmThresholdRange",
                    "description": "Documented safe range for alarm thresholds per parameter."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--354b93da-06e9-4634-a5fd-7f9b7b3a9d5a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0797#AN1929",
                    "external_id": "AN1929"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:22.866Z",
            "name": "Analytic 1929",
            "description": "Real-time monitoring identifies a loss of communication with serially-connected field devices correlated with a configuration change event on the serial-to-Ethernet gateway. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "serialgw:syslog",
                    "channel": "serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SerialBlockCorrelationWindow",
                    "description": "Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--37d989e6-14cd-49a4-adec-3d8b72c8dc22",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0792#AN1924",
                    "external_id": "AN1924"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:04.143Z",
            "name": "Analytic 1924",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) master-role command traffic originating from a source not in the approved control server inventory, directed at multiple field devices in a pattern consistent with control-server behavior. Documented in Maroochy Water Services (falsified PDS/station addresses to impersonate the master) and the 2017 Dallas Siren incident (rogue radio transmitter to 156 sirens). OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706",
                    "name": "assetinventory:MasterAddress",
                    "channel": "command traffic uses master/station address not in registered master addresses"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device receives commands from two distinct master identities within a short window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP/identity allowlist of legitimate master/control server systems."
                },
                {
                    "field": "RegisteredMasterAddresses",
                    "description": "Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."
                },
                {
                    "field": "RogueMasterTimeWindow",
                    "description": "Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--383a1a1c-8ecf-4909-9237-14a1f4fc4179",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0747#AN1880",
                    "external_id": "AN1880"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1880",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--393d7e7b-0790-49e7-9bcd-87ab4662b05e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0789#AN1921",
                    "external_id": "AN1921"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:19.350Z",
            "name": "Analytic 1921",
            "description": "Real-time monitoring identifies iptables/nftables rules on Industrial Control System (ICS) Linux gateways that selectively drop ICS reporting message traffic based on content while allowing command traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Device-specific configured interval for unsolicited reporting."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3c6a21cb-8643-41bc-94a1-e860b02a1cad",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0761#AN1893",
                    "external_id": "AN1893"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:05.430Z",
            "name": "Analytic 1893",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the user program from a field device to a source not in the approved engineering workstation list, where the session byte count is consistent with a substantial portion of the device's program memory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BackupWindowSchedule",
                    "description": "Scheduled periods during which routine backup uploads are expected."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform program uploads from field devices."
                },
                {
                    "field": "ProgramUploadSizeThreshold",
                    "description": "Minimum byte count for a session to be considered a substantial program readback."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3c6aa6f7-29e9-41d9-8500-30b6d0533d64",
            "created": "2026-04-23T00:31:46.350Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0914#AN2057",
                    "external_id": "AN2057"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:07.110Z",
            "name": "Analytic 2057",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol session adding new program blocks or routines to an existing controller program without replacing existing logic, from a source not in the approved engineering workstation list, correlated against the device's program inventory showing a size increase without a corresponding planned update. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706",
                    "name": "assetinventory:ProgramSize",
                    "channel": "device program size/block count increases without corresponding change ticket reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "download of block address not previously present in device program inventory, from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to append program blocks."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3e456d4d-397d-4e04-9261-9399960c9633",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0767#AN1899",
                    "external_id": "AN1899"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:47.678Z",
            "name": "Analytic 1899",
            "description": "Real-time monitoring identifies a network-accessible service process (lsass.exe, a vendor remote management service) spawning an unexpected child process or exhibiting cross-process memory access patterns immediately following inbound connection from an unusual source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate connections to network-facing ICS services are expected."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3f052beb-d384-4ebe-b942-2c4ddeb95833",
            "created": "2026-04-22T21:47:06.445Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0910#AN2053",
                    "external_id": "AN2053"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:09.218Z",
            "name": "Analytic 2053",
            "description": "Real-time monitoring identifies a network infrastructure configuration change that results in a communication gap between previously-connected Industrial Control System (ICS) zones, from a source not in the approved network administration list. This technique-level analytic synthesizes Serial COM (T1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for network infrastructure configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which connectivity-affecting changes are authorized."
                },
                {
                    "field": "CommBlockCorrelationWindow",
                    "description": "Time window correlating a configuration change with subsequent communication loss."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3f10ffe9-fa73-4aeb-bf98-322831bf757f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0731#AN1864",
                    "external_id": "AN1864"
                },
                {
                    "source_name": "McAfee CHIPSEC Blog",
                    "description": "Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against Vault 7 Disclosure Scanning. Retrieved March 13, 2017.",
                    "url": "https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/"
                },
                {
                    "source_name": "MITRE Copernicus",
                    "description": "Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions about BIOS Security. Retrieved December 11, 2015.",
                    "url": "http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about"
                },
                {
                    "source_name": "Intel HackingTeam UEFI Rootkit",
                    "description": "Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html"
                },
                {
                    "source_name": "Github CHIPSEC",
                    "description": "Intel. (2017, March 18). CHIPSEC Platform Security Assessment Framework. Retrieved March 20, 2017.",
                    "url": "https://github.com/chipsec/chipsec"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:00.393Z",
            "name": "Analytic 1864",
            "description": "Real-time monitoring identifies a field device entering firmware update mode and receiving a large data transfer on its firmware-capable protocol port from a source not in the approved engineering workstation list, followed by a device reboot, with post-reboot firmware hash not matching the authorized inventory. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "reported firmware hash post-reboot not in authorized firmware inventory"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device reboot/restart alarm within firmware update window of the flagged transfer session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware write session initiated without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFirmwareInventory",
                    "description": "Cryptographic hash inventory of authorized firmware versions per device model."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update operations."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform firmware updates."
                },
                {
                    "field": "FirmwareSessionSizeThreshold",
                    "description": "Minimum byte count for a session to be considered a firmware transfer rather than routine configuration traffic, derived from known firmware image sizes."
                },
                {
                    "field": "FirmwareUpdateWindow",
                    "description": "Time window within which a device reboot following a large session is considered part of the same firmware update event."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware updates are expected to occur."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--484023ea-6fea-4f91-b40d-c6d87188cbfe",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0788#AN1920",
                    "external_id": "AN1920"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:17.221Z",
            "name": "Analytic 1920",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol session that systematically enumerates a device's full tag/object namespace from a source not in the approved control server list, where the enumeration pattern covers the complete address/object space rather than the sparse, fixed tag set legitimate Supervisory Control and Data Acquisition (SCADA) polling queries. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client identities authorized for namespace browsing."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate polling/browsing sources."
                },
                {
                    "field": "NamespaceCoverageThreshold",
                    "description": "Percentage of total device tag/object space accessed within a session constituting full enumeration."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--48d2023b-469d-4f9f-a4e6-010be72436b9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0776#AN1908",
                    "external_id": "AN1908"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:29.074Z",
            "name": "Analytic 1908",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a parameter/setpoint register where the written value falls outside the documented safe operating range, or where the write originates from a source not in the approved write-source list, correlated with subsequent historian tag drift. Documented precedent: FrostyGoop directly modified Modbus holding register values on ENCO heating controllers in Lviv, Ukraine, causing a two-day remediation outage. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "scada:applog",
                    "channel": "parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to parameter/setpoint registers."
                },
                {
                    "field": "BaselineValueRange",
                    "description": "Documented safe operating range for each monitored parameter."
                },
                {
                    "field": "ParameterDriftThreshold",
                    "description": "Percentage deviation from rolling baseline considered significant drift."
                },
                {
                    "field": "SetpointAddressRange",
                    "description": "Register/address ranges corresponding to parameter and setpoint values for the device type."
                },
                {
                    "field": "TimeWindow",
                    "description": "Time window over which post-write drift is measured."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--51a094bf-b7eb-452a-9b7a-ffac16fce1ac",
            "created": "2026-04-22T18:49:31.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0907#AN2050",
                    "external_id": "AN2050"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:00.318Z",
            "name": "Analytic 2050",
            "description": "Real-time monitoring identifies execution of port scanning utilities (nmap, masscan) with arguments targeting Industrial Control System (ICS) protocol port ranges on an ICS Windows host. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources."
                },
                {
                    "field": "PortScanTimeWindow",
                    "description": "Time window within which connections across multiple ports are considered a single scan event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--55544bb8-440f-4b67-aa35-7e7af5952aca",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0750#AN1882",
                    "external_id": "AN1882"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:26.656Z",
            "name": "Analytic 1882",
            "description": "Real-time monitoring identifies an audit log clearing event or deletion/truncation of an Industrial Control System (ICS) vendor application log file, immediately preceded by other suspicious activity on the same host within a short lookback window. Documented in the CaddyWiper deployment alongside Industroyer2, explicitly intended to destroy evidence and slow forensic recovery. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=104 outside scheduled log rotation window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedLogManagementTools",
                    "description": "Allowlist of processes/accounts authorized to delete or truncate ICS application logs."
                },
                {
                    "field": "LogClearLookbackWindow",
                    "description": "Time window prior to a log-clear event within which other suspicious activity is considered correlated."
                },
                {
                    "field": "ScheduledLogRotationWindow",
                    "description": "Documented schedule for legitimate, automated log rotation/archival."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5610211c-1458-4333-8640-384189d9318e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0781#AN1913",
                    "external_id": "AN1913"
                },
                {
                    "source_name": "Elastic - Koadiac Detection with EQL",
                    "description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.",
                    "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
                },
                {
                    "source_name": "ACSC Email Spoofing",
                    "description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
                },
                {
                    "source_name": "Microsoft Anti Spoofing",
                    "description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
                    "url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:56.723Z",
            "name": "Analytic 1913",
            "description": "Real-time monitoring identifies an email client process on an Industrial Control System (ICS) Linux workstation spawning a child process inconsistent with normal email handling. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of hosts classified as ICS engineering or operator workstations."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--613b28ef-88dd-4008-8d7e-206ce55a7cde",
            "created": "2026-04-22T14:53:50.597Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0902#AN2045",
                    "external_id": "AN2045"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:44.737Z",
            "name": "Analytic 2045",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol message arriving at a device from a source whose identity is not in the approved communication baseline for that destination, where the message is structurally valid but originates outside the documented set of legitimate communicators. This technique-level analytic synthesizes Command Message (T1692.001) and Reporting Message (T1692.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationBaseline",
                    "description": "The complete, maintained inventory of every legitimate source-to-destination communication pair in the ICS environment."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--636e612f-0b63-44e8-bf2c-31b62d20508b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0762#AN1894",
                    "external_id": "AN1894"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1894",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--66070162-d51e-46e7-8d32-2140fd5e7086",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0751#AN1883",
                    "external_id": "AN1883"
                },
                {
                    "source_name": "CopyFromScreen .NET",
                    "description": "Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020.",
                    "url": "https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8"
                },
                {
                    "source_name": "Antiquated Mac Malware",
                    "description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.",
                    "url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:44.933Z",
            "name": "Analytic 1883",
            "description": "Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedScreenCaptureTools",
                    "description": "Allowlist of remote support, training, or documentation tools legitimately authorized to perform screen capture."
                },
                {
                    "field": "CaptureToFileWindow",
                    "description": "Time window correlating a screen capture API call with a subsequent image file write."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--67861309-0ba7-4713-843e-3def87e396ec",
            "created": "2026-04-22T20:45:49.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0909#AN2052",
                    "external_id": "AN2052"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:53.254Z",
            "name": "Analytic 2052",
            "description": "Real-time monitoring identifies Internet Group Management Protocol (IGMP) membership reports for Industrial Control System (ICS) multicast groups from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "networkdevice:snmp",
                    "channel": "Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized to subscribe to ICS multicast groups."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--68073351-4e4f-40e4-9394-a9166bb346d7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0769#AN1901",
                    "external_id": "AN1901"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1901",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6a510bf0-0289-4eb0-8645-89f0f4d32cf3",
            "created": "2026-04-22T17:53:18.908Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0906#AN2049",
                    "external_id": "AN2049"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:59.527Z",
            "name": "Analytic 2049",
            "description": "Configured Windows object-access monitoring identifies a write to a Siemens project file by a process that is not the Siemens Totally Integrated Automation (TIA) Portal or Step7 engineering software, or by the legitimate Siemens tool immediately after loading a project from an untrusted path. Directly documented as a Stuxnet mechanism. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Siemens engineering tool opens project file from path not in approved project repository"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedProjectRepository",
                    "description": "Documented, trusted source location(s) for Siemens project files."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6b3b3e92-bef7-4977-9895-29036bab29f1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0765#AN1897",
                    "external_id": "AN1897"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:46.090Z",
            "name": "Analytic 1897",
            "description": "Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedServiceAdmins",
                    "description": "Accounts authorized to stop/start critical ICS services."
                },
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "CriticalICSServiceList",
                    "description": "List of Windows services whose stoppage constitutes a high-impact event."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6e046c4c-6c93-4fdf-a69e-5d81b52d1e9c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0766#AN1898",
                    "external_id": "AN1898"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:46.920Z",
            "name": "Analytic 1898",
            "description": "Configured Windows object-access monitoring identifies a write to an Industrial Control System (ICS) engineering project file by a process that is not the recognized vendor engineering software, or by the vendor engineering software immediately after loading a project file from an untrusted source. Documented mechanism in Havex (trojanized vendor software/installers distributed via compromised vendor websites). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedProjectRepository",
                    "description": "Documented, trusted source location(s) for project files."
                },
                {
                    "field": "AuthorizedEngineeringTools",
                    "description": "Allowlist of vendor engineering software processes authorized to modify project files."
                },
                {
                    "field": "ProjectFileExtensions",
                    "description": "File extensions used by ICS engineering project files for in-use vendor platforms."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7107739b-92d2-41fa-9fc8-ebe72f6086ee",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0760#AN1892",
                    "external_id": "AN1892"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1892",
            "description": "On Windows and Unix systems monitor executed commands and arguments that may use shell commands for execution. Shells may be common on administrator, developer, or power user systems depending on job function.\n\nOn network device and embedded system CLIs consider reviewing command history if unauthorized or suspicious commands were used to modify device configuration.\nMonitor logs from installed applications (e.g., historian logs) for unexpected commands or abuse of system features.\nMonitor for processes spawning from known command shell applications (e.g., PowerShell, Bash). Benign activity will need to be allow-listed. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "Command",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "Application Log",
                    "channel": "None"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "Process",
                    "channel": "None"
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--77857bc3-6a38-4826-8109-30facf6c23ec",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0737#AN1870",
                    "external_id": "AN1870"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:27.401Z",
            "name": "Analytic 1870",
            "description": "Real-time network monitoring identifies a source issuing write commands to the same Input/Output (I/O) point or register address at a rate significantly exceeding the device's configured scan cycle. The write rate itself is the signature, with source identity retained as corroborating context; treat the rate deviation as suspicious only after excluding tuning, commissioning, failover, and fault-recovery activity. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write function code to same register address at rate exceeding max write rate per point within brute force detection window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "scada:applog",
                    "channel": "write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BruteForceDetectionWindow",
                    "description": "Time window over which write rate is measured for threshold comparison."
                },
                {
                    "field": "MaxNormalStateChangeRate",
                    "description": "Maximum rate at which the physical process value is expected to legitimately change state."
                },
                {
                    "field": "MaxWriteQueueDepth",
                    "description": "Maximum legitimate write queue depth for SCADA/DCS write operations to a single point."
                },
                {
                    "field": "MaxWriteRatePerPoint",
                    "description": "Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7841eb6b-8a05-4754-b738-a475bfbb89fb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0773#AN1905",
                    "external_id": "AN1905"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:53.888Z",
            "name": "Analytic 1905",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol write to output register addresses on a field device from a source not in the approved write-source list, correlated with a discrepancy between the value reported by the Input/Output (I/O) image and an independent measurement of the actual physical output state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. The independent measurement is process-state telemetry, not network-flow evidence; implementation requires a separately trusted sensor/historian/measurement path with time alignment and an engineering-defined tolerance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Content",
                    "channel": "write function code to output register address range from source not in approved write sources"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "processsensor:RedundantComparison",
                    "channel": "Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to I/O output registers."
                },
                {
                    "field": "IOIntegrityToleranceThreshold",
                    "description": "Acceptable divergence between reported I/O image value and independently measured physical state."
                },
                {
                    "field": "OutputRegisterAddressRange",
                    "description": "Register/address ranges corresponding to physical outputs for the device type."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--78615cd7-6a14-4921-aaa9-2aae0774f0f1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0755#AN1887",
                    "external_id": "AN1887"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:20.438Z",
            "name": "Analytic 1887",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol mode-change command targeting a field device from a source not in the approved engineering workstation list, where the transition is not immediately followed by a corresponding operator acknowledgment. Documented in Triton (the Tricon controller had to be placed in PROGRAM mode before the attack could inject its payload). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device mode-change alarm generated without corresponding operator_id entry within mode change ack window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "mode-change service from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "mode-change session logged without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which mode changes are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue mode-change commands."
                },
                {
                    "field": "ModeChangeAckWindow",
                    "description": "Time window within which a legitimate operator acknowledgment is expected following a mode-change event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--791310ad-7db5-41df-9fa5-fa4097d8a51d",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0725#AN1858",
                    "external_id": "AN1858"
                },
                {
                    "source_name": "Twitter ItsReallyNick Masquerading Update",
                    "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved September 12, 2024.",
                    "url": "https://x.com/ItsReallyNick/status/1055321652777619457"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:23.840Z",
            "name": "Analytic 1858",
            "description": "Real-time monitoring identifies a process or scheduled task whose displayed name matches a known Industrial Control System (ICS) vendor application but whose on-disk binary hash or file path does not match the vendor-signed baseline. The mismatch -- name says one thing, binary integrity says another -- is the defining signal. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AssetInventoryDeviceTypes",
                    "description": "Maintained inventory of expected vendor/product identity strings per enrolled device IP."
                },
                {
                    "field": "ICSDaemonNames",
                    "description": "List of expected Linux ICS service daemon process names."
                },
                {
                    "field": "ICSVendorProcessNames",
                    "description": "List of known ICS vendor executable names used as the masquerade-target watchlist."
                },
                {
                    "field": "VendorHashBaseline",
                    "description": "Cryptographic hash inventory for all legitimate versions of vendor ICS binaries, updated on every patch cycle."
                },
                {
                    "field": "VendorInstallPaths",
                    "description": "Authorized installation directories for each ICS vendor application."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7aa60595-5a1c-4de2-be60-cc1f9fea2313",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0770#AN1902",
                    "external_id": "AN1902"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:48.446Z",
            "name": "Analytic 1902",
            "description": "Real-time monitoring identifies execution of network enumeration commands (netstat, arp -a, Get-NetTCPConnection) on an Industrial Control System (ICS) host from an account not associated with documented network administration, where multiple such commands execute in sequence within a short window. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAdmins",
                    "description": "Accounts with documented network administration responsibilities."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for topology queries."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic mapping sequence."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7ec4b791-7054-442f-8967-6d6fa5e8678b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0786#AN1918",
                    "external_id": "AN1918"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1918",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8428e0cd-009e-41c1-8292-88651d4486c9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0729#AN1862",
                    "external_id": "AN1862"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1862",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--87f5d864-d79b-474a-a3b4-43673dcb9f90",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0796#AN1928",
                    "external_id": "AN1928"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:31.506Z",
            "name": "Analytic 1928",
            "description": "Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "OrganizationalIPSpace",
                    "description": "Documented internal/organizational IP address ranges."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--880a1133-6639-42f0-96a8-3e914426d38b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0790#AN1922",
                    "external_id": "AN1922"
                },
                {
                    "source_name": "McAfee CHIPSEC Blog",
                    "description": "Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against Vault 7 Disclosure Scanning. Retrieved March 13, 2017.",
                    "url": "https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/"
                },
                {
                    "source_name": "MITRE Copernicus",
                    "description": "Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions about BIOS Security. Retrieved December 11, 2015.",
                    "url": "http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about"
                },
                {
                    "source_name": "Intel HackingTeam UEFI Rootkit",
                    "description": "Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html"
                },
                {
                    "source_name": "Github CHIPSEC",
                    "description": "Intel. (2017, March 18). CHIPSEC Platform Security Assessment Framework. Retrieved March 20, 2017.",
                    "url": "https://github.com/chipsec/chipsec"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:02.622Z",
            "name": "Analytic 1922",
            "description": "Real-time monitoring identifies a firmware write command targeting a specific Input/Output (I/O) module slot address within a controller chassis from a source not in the approved engineering workstation list, distinguishing module-level firmware modification from main-processor firmware updates by its slot-addressed targeting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "module-specific firmware hash post-write does not match authorized module firmware inventory"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedModuleFirmwareInventory",
                    "description": "Hash inventory of authorized firmware versions per I/O module type and slot position."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which module firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform module-level firmware updates."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--882f2365-4c14-4c48-8eef-2a7c293c8569",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0783#AN1915",
                    "external_id": "AN1915"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:06.365Z",
            "name": "Analytic 1915",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol write to an existing program block from a source not in the approved engineering workstation list, outside a scheduled change-control window, correlated against post-modification program hash comparison and measurable change in controller Input/Output (I/O) behavior. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d",
                    "name": "assetinventory:ProgramHash",
                    "channel": "program hash differs from last authorized baseline without corresponding change ticket reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write to existing program block address from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "device:VendorLog",
                    "channel": "measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which program modifications are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to modify existing controller program blocks."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--899d0dce-64f7-4924-93a1-8e3c83dd510f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0730#AN1863",
                    "external_id": "AN1863"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:26.988Z",
            "name": "Analytic 1863",
            "description": "Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "fim:hashcompare",
                    "channel": "installed binary hash does not match vendor-published checksum for claimed version"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "VendorInstallManifest",
                    "description": "Documented list of files/registry keys a legitimate vendor installer is expected to create."
                },
                {
                    "field": "VendorInstallProfile",
                    "description": "Documented expected process behavior for a legitimate vendor installer, established through lab testing."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--899d41e8-8d02-45f9-ab8a-3a06f4cc4189",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0768#AN1900",
                    "external_id": "AN1900"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:06.181Z",
            "name": "Analytic 1900",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol requests specifically targeting mode/status registers from a source not in the approved control server or engineering workstation list, where the request pattern is narrowly focused on mode/state data rather than broader process value polling. Directly documented in the Triton attack chain's 'Get Control Program Status' request. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate engineering and SCADA systems authorized to query device operating mode."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--89ca8617-20fd-404b-9afb-dcfd2684a791",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0757#AN1889",
                    "external_id": "AN1889"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1889",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8c77f31f-c6f4-491c-965a-e25c506b0c68",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0779#AN1911",
                    "external_id": "AN1911"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1911",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--908fe88b-d8e2-47d1-b6a4-7a42b3bbe09b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0803#AN1935",
                    "external_id": "AN1935"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:42.856Z",
            "name": "Analytic 1935",
            "description": "Real-time monitoring identifies authentication to an external remote access gateway using credentials associated with Industrial Control System (ICS)-role accounts, from a source geolocation or Autonomous System Number (ASN) inconsistent with the account's established usage pattern, immediately followed by that session establishing connectivity into the ICS network zone. Documented in VPNFilter, which specifically targeted routers and network edge devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "vpn:applog",
                    "channel": "session duration or command activity inconsistent with documented vendor support session profiles"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "vpn:authlog",
                    "channel": "Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedRemoteAccessOrigins",
                    "description": "Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."
                },
                {
                    "field": "ExpectedSessionPattern",
                    "description": "Baseline of normal session timing/duration for each ICS-role account's remote access usage."
                },
                {
                    "field": "RemoteAccessToICSWindow",
                    "description": "Time window correlating VPN authentication with subsequent ICS-zone network access."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9127dd4e-0994-442f-8d73-b6b2dfb1f9ac",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0744#AN1877",
                    "external_id": "AN1877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:36.505Z",
            "name": "Analytic 1877",
            "description": "Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X."
                },
                {
                    "field": "NewDeviceWindow",
                    "description": "Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--930aae7c-e8f0-4594-8e3f-f0e71d7e1640",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0745#AN1878",
                    "external_id": "AN1878"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:25.745Z",
            "name": "Analytic 1878",
            "description": "Real-time monitoring identifies a file written to an Industrial Control System (ICS) host from a remote network share, where the file has an executable or script extension, immediately followed by execution of that file from the same path. Documented in the PIPEDREAM toolkit's modular design, where components transfer files to compromised Programmable Logic Controllers (PLCs) and engineering workstations. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 with executable/script extension from remote-sourced write operation"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of the newly-created file within tool transfer window of its creation"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFileSources",
                    "description": "Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "SuspiciousFilePatterns",
                    "description": "Filename/extension patterns inconsistent with the device's normal configuration exchange profile."
                },
                {
                    "field": "ToolTransferWindow",
                    "description": "Time window after file creation within which execution is considered directly connected to the transfer event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--96e7b86f-b960-489c-882b-9dcdb1c44aa9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0802#AN1934",
                    "external_id": "AN1934"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:24.377Z",
            "name": "Analytic 1934",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol message sequence placing a field device into firmware-update mode from a source not in the approved engineering workstation list, correlated with the device's alarm telemetry going silent within a short grace period without acknowledgment. Documented precedent: Industroyer exploited CVE-2015-5374 by sending a crafted packet that initiated an incomplete firmware update sequence on Siemens Protection Technology (SIPROTEC) relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "firmware-update-mode activation service from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware update mode entry logged without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmSilenceGracePeriod",
                    "description": "Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update mode activation."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware update mode activation is authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to activate firmware update mode."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware update activities are expected."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--981b659b-992a-4d71-9404-0e1b2b598e50",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0736#AN1869",
                    "external_id": "AN1869"
                },
                {
                    "source_name": "University of Birmingham C2",
                    "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
                    "url": "https://arxiv.org/pdf/1408.1136"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:33.391Z",
            "name": "Analytic 1869",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) host or server establishing outbound connections on a commonly-allowed port (e.g., 443, 80, 8080, 53, etc.) to a destination not in the approved vendor/business domain list, where that host's documented network role does not require external connectivity. Documented real-world use: Sandworm's 2015 Ukraine power grid attack used port 443 for Command and Control (C2) communications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. SNI and certificate attributes are TLS/session metadata; do not treat them as decrypted payload content. Encrypted application content requires a separate inspection point.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "zeek:ssl",
                    "channel": "Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor domains for software updates, licensing, or remote support."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose documented function never requires outbound internet connectivity."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9ad83be0-5c88-4fb6-b59d-19db21176923",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0733#AN1866",
                    "external_id": "AN1866"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:38.213Z",
            "name": "Analytic 1866",
            "description": "Real-time monitoring identifies a Universal Serial Bus (USB) storage device insertion event on an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) workstation where the device's hardware identifier (ID) is not in the authorized USB allowlist, immediately followed by process execution from the removable drive's path. Documented as the primary infection vector for Stuxnet, which specifically targeted air-gapped Siemens engineering environments via infected USB drives. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedUSBAllowlist",
                    "description": "Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "USBExecutionWindow",
                    "description": "Time window after device insertion/mount within which process execution is considered directly connected to the insertion event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--aebd2848-98db-46f1-8e22-627e2ec3c280",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0753#AN1885",
                    "external_id": "AN1885"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:24.271Z",
            "name": "Analytic 1885",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e",
                    "name": "edr:Syscall",
                    "channel": "DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to interact with ICS hardware/protocols."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--afc9e394-147e-49db-81df-953d2d3ea93e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0764#AN1896",
                    "external_id": "AN1896"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:18.240Z",
            "name": "Analytic 1896",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Windows host simultaneously holding connections to both the field device subnet and an unexpected external or inter-zone destination, combined with proxy-capable process spawning and ICS vendor application logs showing endpoint or certificate changes. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "vendorapp:ApplicationLog",
                    "channel": "Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AiTMCorrelationWindow",
                    "description": "Time window within which a MAC binding change and protocol baseline deviation are considered correlated."
                },
                {
                    "field": "ExpectedNextHopBaseline",
                    "description": "Documented expected network path for device subnet traffic."
                },
                {
                    "field": "TopologyChangeTicket",
                    "description": "Change-management reference confirming an authorized hardware replacement or topology modification."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b337bf06-d69b-41e0-8e60-8f24cb718998",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0798#AN1930",
                    "external_id": "AN1930"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:33.957Z",
            "name": "Analytic 1930",
            "description": "Real-time monitoring identifies field device access using credentials matching hardcoded values extracted from Industrial Control System (ICS) vendor firmware or configuration files, from a source with no legitimate operational role. Documented in TriStation 1131 v4.9.0 and earlier, which contained undocumented power-user accounts with hardcoded credentials. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "KnownHardcodedCredentialPatterns",
                    "description": "Documented hardcoded credential values for in-use ICS products, where publicly disclosed by vendors or security researchers."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b6fb91d0-28f6-447d-ba25-e7b26116ebfe",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0738#AN1871",
                    "external_id": "AN1871"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:37.455Z",
            "name": "Analytic 1871",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "NSM:Connections",
                    "channel": "device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "device:VendorLog",
                    "channel": "protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window within which a device/process crash and subsequent privileged action are considered correlated."
                },
                {
                    "field": "KnownVulnerableDriverSignatures",
                    "description": "Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique)."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b74100d1-0085-468a-834a-2bf10924a3b7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0752#AN1884",
                    "external_id": "AN1884"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:05.622Z",
            "name": "Analytic 1884",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706",
                    "name": "assetinventory:ProgramHash",
                    "channel": "post-transfer program hash does not match last authorized program baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "program download session logged without corresponding change ticket reference"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which program downloads are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform program downloads."
                },
                {
                    "field": "ModeChangeToDownloadWindow",
                    "description": "Time window within which a mode-change event and subsequent download session are considered the same engineering action."
                },
                {
                    "field": "ProgramDownloadSizeThreshold",
                    "description": "Minimum byte count distinguishing a full program download from routine traffic."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c14544a4-5ca1-4523-97eb-4a9840d74c6d",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0743#AN1876",
                    "external_id": "AN1876"
                },
                {
                    "source_name": "Nzyme Alerts Intro",
                    "description": "Koopmann, Lennart. (n.d.). Nzyme Alerts Introduction. Retrieved November 17, 2024.",
                    "url": "https://docs.nzyme.org/wifi/monitoring/network-monitoring/"
                },
                {
                    "source_name": "Wireless Intrusion Detection",
                    "description": "Tomko, A.; Rieser, C; Buell, H.; Zeret, D.; Turner, W.. (2007, March). Wireless Intrusion Detection. Retrieved September 26, 2022.",
                    "url": "https://apps.dtic.mil/sti/pdfs/ADA466332.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:04.063Z",
            "name": "Analytic 1876",
            "description": "Real-time monitoring identifies indirect evidence of passive RF capture on Industrial Control System (ICS) wireless frequencies -- an unassociated device's RF signature detected without a completed association sequence, or a known device's Media Access Control (MAC) address detected from a location/signal strength inconsistent with its registered installation point. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "wireless:spectrum",
                    "channel": "Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/identity inventory of all devices authorized on the ICS wireless segment."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless capture for diagnostics."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c40ddd75-f2fc-4899-bda1-bff164c96622",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0774#AN1906",
                    "external_id": "AN1906"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:54.639Z",
            "name": "Analytic 1906",
            "description": "Real-time monitoring identifies a single Industrial Control System (ICS) protocol session reading the complete Input/Output (I/O) image from a field device, rather than the sparse, fixed tag subset that legitimate Supervisory Control and Data Acquisition (SCADA) polling queries, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate polling sources."
                },
                {
                    "field": "FullImageCoverageThreshold",
                    "description": "Percentage of total device address space read within a single session constituting a full I/O image read."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c556c91d-64a0-401c-9c41-18971eeca0f2",
            "created": "2026-04-22T15:07:57.495Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0903#AN2046",
                    "external_id": "AN2046"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:21.233Z",
            "name": "Analytic 2046",
            "description": "Real-time monitoring identifies iptables/nftables rule changes on Industrial Control System (ICS) Linux gateways that selectively block one ICS communication traffic type. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommunicationGapThreshold",
                    "description": "Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--cbf791b4-5186-4205-ac5a-a56042aaebec",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0778#AN1910",
                    "external_id": "AN1910"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1910",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--cd4c92f9-3107-45c7-9d95-19a44d7dc92c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0732#AN1865",
                    "external_id": "AN1865"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1865",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--cff25f71-859e-48bf-88d6-852d05e22b33",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0723#AN1856",
                    "external_id": "AN1856"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:29.258Z",
            "name": "Analytic 1856",
            "description": "Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "scada:applog",
                    "channel": "device communication-loss alarm generated within detection window of a corresponding network flood alert"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CPUUtilizationThreshold",
                    "description": "Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."
                },
                {
                    "field": "DoSConnectionThreshold",
                    "description": "Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."
                },
                {
                    "field": "DoSDetectionWindow",
                    "description": "Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."
                },
                {
                    "field": "ExpectedPollInterval",
                    "description": "Device-specific supervisory poll interval used to determine what counts as a process historian gap."
                },
                {
                    "field": "InterfaceErrorThreshold",
                    "description": "Deviation from baseline interface error/discard rate, tuned against historical interface health data."
                },
                {
                    "field": "MalformedPacketThreshold",
                    "description": "Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d271c7fc-d76a-4fb0-a645-5db2c1223a32",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0799#AN1931",
                    "external_id": "AN1931"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:22.783Z",
            "name": "Analytic 1931",
            "description": "Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "dns:querylog",
                    "channel": "Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor/business domains for application-layer protocol traffic."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose role does not require external application-layer connectivity."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d3023733-5874-4746-a947-65925514e382",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0771#AN1903",
                    "external_id": "AN1903"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:33.230Z",
            "name": "Analytic 1903",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol commands changing device-level credentials or access codes from a source not in the approved security administration list, where the device subsequently rejects connections from legitimate control system components. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "credential/access code change command from source not in approved security admin list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedCredentialAdmins",
                    "description": "Accounts authorized to change credentials for ICS service and operator accounts."
                },
                {
                    "field": "CredentialChangeImpactWindow",
                    "description": "Time window after a credential change within which a service authentication failure is considered directly connected."
                },
                {
                    "field": "CredentialRotationSchedule",
                    "description": "Documented schedule for routine credential rotation."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d71e98fa-64d1-4ddb-acb1-bba1e4af6a73",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0785#AN1917",
                    "external_id": "AN1917"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Analytic 1917",
            "description": "No standard detection method currently exists for this technique.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "None"
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d937e4b8-20f2-44c1-9940-48c74318c715",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0791#AN1923",
                    "external_id": "AN1923"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:51.681Z",
            "name": "Analytic 1923",
            "description": "Real-time monitoring identifies a user-invoked action on an Industrial Control System (ICS) workstation immediately followed by a process execution chain inconsistent with normal ICS operations -- the user-driven trigger plus the resulting anomalous execution chain together distinguish this from generic malware execution. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 from resulting process to destinations not in approved destinations list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDestinations",
                    "description": "Allowlist of network destinations consistent with legitimate document/link content."
                },
                {
                    "field": "ExpectedDocumentViewerChildren",
                    "description": "Documented normal child processes for legitimate document viewers/handlers."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--dc014060-5116-4a2f-bac5-35ac1db8fabb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0772#AN1904",
                    "external_id": "AN1904"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:29.050Z",
            "name": "Analytic 1904",
            "description": "Real-time monitoring identifies an interactive desktop session Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), or vendor remote console to an Human-Machine Interface (HMI) or engineering station from a source Internet Protocol (IP) addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or from an account not in the approved operator/engineer list, where the session subsequently interacts with Industrial Control System (ICS) control elements. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementCIDR",
                    "description": "IP ranges authorized for remote desktop/console access to ICS hosts."
                },
                {
                    "field": "ApprovedOperatorList",
                    "description": "Accounts with documented operator/engineer roles."
                },
                {
                    "field": "ApprovedOperatorWorkstations",
                    "description": "Inventory of workstations from which operator/engineer interactive sessions are expected to originate."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--dd25b818-ceb0-4518-9384-dcf895d4956b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0740#AN1873",
                    "external_id": "AN1873"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:21.575Z",
            "name": "Analytic 1873",
            "description": "Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "webserver:applog",
                    "channel": "Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate access to the ICS web interface is expected."
                },
                {
                    "field": "ExploitPatternSignatures",
                    "description": "Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."
                },
                {
                    "field": "ExploitToShellWindow",
                    "description": "Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ddfcd948-3526-4241-a12f-d7bf63468e40",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0724#AN1857",
                    "external_id": "AN1857"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:23.108Z",
            "name": "Analytic 1857",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS)-role account authenticating via interactive or remote logon from a workstation not in the approved host inventory, or outside the account's established usage pattern, immediately followed within a short window by that session connecting to the field device network or ICS application. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 to device subnet within auth-to-device window of the anomalous logon"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedAdminCIDR",
                    "description": "IP ranges from which SSH administrative access to ICS Linux assets is authorized."
                },
                {
                    "field": "ApprovedHostList",
                    "description": "Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."
                },
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges from which network device administrative access is authorized."
                },
                {
                    "field": "AuthToDeviceWindow",
                    "description": "Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."
                },
                {
                    "field": "ICSRoleAccountPatterns",
                    "description": "Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."
                },
                {
                    "field": "OfficeHoursWindow",
                    "description": "Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--df7f8849-56a7-4e83-9fd7-a4f25227d960",
            "created": "2026-04-22T22:41:28.415Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0911#AN2054",
                    "external_id": "AN2054"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:03.255Z",
            "name": "Analytic 2054",
            "description": "Real-time monitoring identifies a Windows network-adapter disable or administrative interface-down event on an ICS gateway or protocol-converter host outside the approved network-maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "WinEventLog:System",
                    "channel": "network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for switch configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which interface configuration changes are authorized."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e25ef816-bbfd-4656-8ecb-c7eebcba31d4",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0734#AN1867",
                    "external_id": "AN1867"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:28.497Z",
            "name": "Analytic 1867",
            "description": "Real-time network monitoring identifies a source issuing systematic, sequential Industrial Control System (ICS) protocol reads sweeping the full register/address range across multiple field devices within a short time window, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "historian:applog",
                    "channel": "bulk export query returning above bulk query threshold records from account not in approved historian clients"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/historian servers."
                },
                {
                    "field": "AutoCollectionTimeWindow",
                    "description": "Time window within which sequential reads across multiple devices are considered part of a single automated collection event."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Record count threshold above which a historian query is considered a bulk export rather than a routine query."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e379be82-39d7-4ae4-8557-f846ba19cd4b",
            "created": "2026-04-23T00:08:52.524Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0913#AN2056",
                    "external_id": "AN2056"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:07.989Z",
            "name": "Analytic 2056",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the complete program, configuration, and data block set from a field device in a single session from a source not in the approved engineering workstation list, distinguished from a partial Program Upload by the comprehensiveness of the read. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "full upload session outside backup window schedule without documented backup purpose"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BackupWindowSchedule",
                    "description": "Scheduled periods during which routine full backups are expected."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform full program uploads."
                },
                {
                    "field": "FullUploadSizeThreshold",
                    "description": "Byte count threshold distinguishing a full program upload from a partial/diagnostic read."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e8f51c53-fc55-441b-a45f-ba7709ccbce2",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0742#AN1875",
                    "external_id": "AN1875"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:39.237Z",
            "name": "Analytic 1875",
            "description": "Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedApplicationList",
                    "description": "Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."
                },
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to invoke write/control methods."
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of process executables permitted to load ICS vendor automation API libraries."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ec695157-8c3c-439b-9925-459c9d4172f0",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0780#AN1912",
                    "external_id": "AN1912"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:01.941Z",
            "name": "Analytic 1912",
            "description": "Periodic or event-triggered integrity verification identifies a discrepancy between a field device's self-reported diagnostic state and an independently verified hardware/firmware fingerprint, indicating the device's reporting layer has been compromised. MITRE explicitly notes firmware/module rootkits 'can also be developed for the Input/Output (I/O) that is attached to an asset.'. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "FirmwareIntegrityScanSchedule",
                    "description": "Frequency of out-of-band firmware integrity verification."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ece52da2-ac60-4b0e-863f-ebbc95118a8c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0759#AN1891",
                    "external_id": "AN1891"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:13.553Z",
            "name": "Analytic 1891",
            "description": "Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "RelayCorrelationWindow",
                    "description": "Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--edd8297d-ec63-4b54-8d28-106f228dd535",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0728#AN1861",
                    "external_id": "AN1861"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:19.686Z",
            "name": "Analytic 1861",
            "description": "Real-time monitoring of the alarm and process historian layer identifies an alarm status transitioning to suppressed, shelved, disabled, or acknowledged without a corresponding operator action recorded within a grace period, correlated with Industrial Control System (ICS) protocol write traffic to alarm configuration or threshold registers arriving in the same window from a source not in the approved engineering list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Content",
                    "channel": "write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmConfigAddressRange",
                    "description": "Protocol register/address ranges corresponding to alarm threshold and configuration values per device type."
                },
                {
                    "field": "AlarmConfigPaths",
                    "description": "File system paths for alarm configuration files/databases on Windows alarm servers."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to ICS devices, including alarm configuration."
                },
                {
                    "field": "HMIAlarmParentAllowlist",
                    "description": "Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration."
                },
                {
                    "field": "SuppressGracePeriod",
                    "description": "Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f123f13f-b6f4-4e86-96cd-14df0e855e0f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0787#AN1919",
                    "external_id": "AN1919"
                },
                {
                    "source_name": "Elastic - Koadiac Detection with EQL",
                    "description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.",
                    "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:50.905Z",
            "name": "Analytic 1919",
            "description": "Real-time monitoring identifies remote Windows system-information queries using WMI/CIM, WinRM, PowerShell remoting, or equivalent management tooling where the command names a non-local target and the account/source is outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for device identification queries."
                },
                {
                    "field": "ApprovedSystemAdmins",
                    "description": "Accounts with documented system administration responsibilities."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f12aa823-91cc-40e1-93b7-eaa5f5fa9c4d",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0756#AN1888",
                    "external_id": "AN1888"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:27.472Z",
            "name": "Analytic 1888",
            "description": "Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f6324642-d17d-49d4-90b2-bab9d229d6fa",
            "created": "2026-04-22T20:31:39.088Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0908#AN2051",
                    "external_id": "AN2051"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:52.486Z",
            "name": "Analytic 2051",
            "description": "Real-time monitoring identifies new Internet Group Management Protocol (IGMP) joins or broadcast traffic spikes on Industrial Control System (ICS) Virtual Local Area Networks (VLANs) from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "networkdevice:snmp",
                    "channel": "new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized on the ICS network segment."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f666f516-f8d0-41f6-9a4c-0ac6c1f6086b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0758#AN1890",
                    "external_id": "AN1890"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:27.721Z",
            "name": "Analytic 1890",
            "description": "Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "gpo:deployment",
                    "channel": "destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:System",
                    "channel": "System crash or unexpected halt occurring within wiper crash window of the bulk deletion event"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedDataManagementTools",
                    "description": "Allowlist of backup/archival/retention management tools authorized to perform bulk file operations."
                },
                {
                    "field": "BulkDeletionThreshold",
                    "description": "File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup."
                },
                {
                    "field": "DataDestructionTimeWindow",
                    "description": "Time window over which bulk deletion activity is measured."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue memory erase commands."
                },
                {
                    "field": "WiperCrashWindow",
                    "description": "Time window after bulk deletion within which a system crash is considered part of the same destructive event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--fbd4686e-f637-459b-ad48-c6fd7840acfa",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0795#AN1927",
                    "external_id": "AN1927"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:59.428Z",
            "name": "Analytic 1927",
            "description": "Real-time monitoring identifies malformed or out-of-spec ICS protocol exchanges targeting an embedded device from a source outside the approved communication baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window correlating a memory access event with a subsequent crash."
                },
                {
                    "field": "TrustedSecurityToolList",
                    "description": "Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--fc6641ac-5748-4498-89e9-d4ada2b6f88a",
            "created": "2026-04-22T15:53:18.404Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0904#AN2047",
                    "external_id": "AN2047"
                },
                {
                    "source_name": "McAfee CHIPSEC Blog",
                    "description": "Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against Vault 7 Disclosure Scanning. Retrieved March 13, 2017.",
                    "url": "https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/"
                },
                {
                    "source_name": "MITRE Copernicus",
                    "description": "Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions about BIOS Security. Retrieved December 11, 2015.",
                    "url": "http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about"
                },
                {
                    "source_name": "Intel HackingTeam UEFI Rootkit",
                    "description": "Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20170313124421/http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html"
                },
                {
                    "source_name": "Github CHIPSEC",
                    "description": "Intel. (2017, March 18). CHIPSEC Platform Security Assessment Framework. Retrieved March 20, 2017.",
                    "url": "https://github.com/chipsec/chipsec"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:03.392Z",
            "name": "Analytic 2047",
            "description": "Real-time monitoring identifies the full firmware modification chain: a device entering firmware-update mode, receiving a large data transfer on a firmware-capable protocol port from a source not in the approved engineering workstation list, rebooting, and reporting a post-reboot firmware hash that does not match the authorized inventory. This technique-level analytic synthesizes System Firmware (T1693.001) and Module Firmware (T1693.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device reboot within firmware update window of the flagged transfer session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "large session on firmware-capable port from source not in engineering workstation list outside change control window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFirmwareInventory",
                    "description": "Cryptographic hash inventory of authorized firmware versions, covering both main processor and module-level firmware."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform firmware updates."
                },
                {
                    "field": "FirmwareUpdateWindow",
                    "description": "Time window within which a device reboot following a large transfer session is considered part of the same firmware update event."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--fcfe9c48-3a5a-49c8-96c3-be79414a8419",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0801#AN1933",
                    "external_id": "AN1933"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:23.610Z",
            "name": "Analytic 1933",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol restart/reset command directed at a field device from a source not in the approved engineering workstation list, particularly where multiple devices receive restart commands within a short window. Documented precedent: Industroyer exploited CVE-2015-5374 via a crafted 18-byte User Datagram Protocol (UDP) packet to port 50000 on Siemens SIPROTEC relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "restart/reset service from source not in engineering workstation list outside change control window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Content",
                    "channel": "non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which restarts are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--1177a4c5-31c8-400c-8544-9071166afa0e",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0045",
                    "external_id": "DC0045"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Windows Registry Key Deletion",
            "description": "The removal of a registry key within the Windows operating system.\n\n*Data Collection Measures:*\n\n- Windows Event Logs\n    - Event ID 4658 - Registry Key Handle Closed: Captures when a handle to a registry key is closed, which may indicate deletion.\n    - Event ID 4660 - Object Deleted: Logs when a registry key is deleted.\n- Sysmon (System Monitor) for Windows\n    - Sysmon Event ID 12 - Registry Key Deleted: Logs when a registry key is removed.\n    - Sysmon Event ID 13 - Registry Value Deleted: Captures removal of specific registry values.\n- Endpoint Detection and Response (EDR) Solutions\n    - Monitor registry deletions for suspicious behavior.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Windows Registry",
                    "channel": "None"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0082",
                    "external_id": "DC0082"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:42.443Z",
            "name": "Network Connection Creation",
            "description": "The initial establishment of a network session, where a system or process initiates a connection to a local or remote endpoint. This typically involves capturing socket information (source/destination IP, ports, protocol) and tracking session metadata. Monitoring these events helps detect lateral movement, exfiltration, and command-and-control (C2) activities.\n\n*Data Collection Measures:*\n\n- Windows:\n    - Event ID 5156 – Filtering Platform Connection - Logs network connections permitted by Windows Filtering Platform (WFP).\n    - Sysmon Event ID 3 – Network Connection Initiated - Captures process, source/destination IP, ports, and parent process.\n- Linux/macOS:\n    - Netfilter (iptables), nftables logs - Tracks incoming and outgoing network connections.\n    - AuditD (`connect` syscall) - Logs TCP, UDP, and ICMP connections.\n    - Zeek (`conn.log`) - Captures protocol, duration, and bytes transferred.\n- Cloud & Network Infrastructure:\n    - AWS VPC Flow Logs / Azure NSG Flow Logs - Logs IP traffic at the network level in cloud environments.\n    - Zeek (conn.log) or Suricata (network events) - Captures packet metadata for detection and correlation.\n- Endpoint Detection & Response (EDR):\n    - Detect anomalous network activity such as new C2 connections or data exfiltration attempts.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "auditd:SYSCALL",
                    "channel": "connect"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "connect/sendto"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open or connect syscalls on /tmp/ssh-* or $SSH_AUTH_SOCK"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/connect with TLS context by unexpected process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/bind: New bind() to a previously closed port shortly after the sequence."
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "sendto/connect"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "outbound connections"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/bind: Process binds to a new local port shortly after knock"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/connect calls showing SSH processes forwarding arbitrary ports"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "openat,connect -k discovery"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Outbound connection to 169.254.169.254 from EC2 workload"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Large transfer volume (>20MB) from RDS IP range to external public IPs"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "High outbound traffic from new region resource"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Outbound connections to port 22, 3389"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Traffic observed on mirror destination instance"
                },
                {
                    "name": "cni:netflow",
                    "channel": "outbound connection to internal or external APIs"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "socket connect"
                },
                {
                    "name": "esxi:esxupdate",
                    "channel": "/var/log/esxupdate.log or /var/log/vmksummary.log"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "System service interactions"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Service initiated connections"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Service-Based Network Connection"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "protocol egress"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "network activity"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "None"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "network session initiation with external HTTPS services"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socket_events to broker/service, where deployed"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socket_events to DNS/DoH/DoT destinations, where deployed"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socket_events for Python-originated connections, where deployed"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socket_events for runtime-originated connections, where deployed "
                },
                {
                    "name": "linux:osquery",
                    "channel": "family=AF_PACKET or protocol raw; process name not in allowlist."
                },
                {
                    "name": "linux:syslog",
                    "channel": "network"
                },
                {
                    "name": "linux:syslog",
                    "channel": "postfix/smtpd"
                },
                {
                    "name": "linux:syslog",
                    "channel": "New Wi-Fi connection established or repeated association failures"
                },
                {
                    "name": "linux:syslog",
                    "channel": "None"
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "EventCode=3, 22"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_CONNECT"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events/socket_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "execution of trusted tools interacting with external endpoints"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd or network_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events + launchd"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events, socket_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CONNECT: Long-lived connections from remote-control parents to external IPs/domains"
                },
                {
                    "name": "macos:osquery",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "connection attempts"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "connection open"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "network connection events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "First outbound connection from the same PID/user shortly after an inbound trigger."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "network sessions initiated by remote desktop apps"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Inbound connections to VNC/SSH ports"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "network"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Outbound Traffic"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "networkd or socket"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream network activity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Association and authentication events including failures and new SSIDs"
                },
                {
                    "name": "Network",
                    "channel": "None"
                },
                {
                    "name": "Network Traffic",
                    "channel": "None"
                },
                {
                    "name": "networkdevice:Flow",
                    "channel": "Traffic from mirrored interface to mirror target IP"
                },
                {
                    "name": "NetworkDevice:Syslog",
                    "channel": "Permitted/denied connection creation where network devices record it"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Dynamic route changes"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "New device-to-broker relationship outside documented profile"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "web domain alerts"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "New outbound connection from Safari/Chrome/Firefox/Word"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Outbound connection after script or installer launch"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "Outbound Connections"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "proxy or TLS inspection logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "log entries indicating network connection initiation on macOS"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New TCP/443 or TCP/80 to domain not previously seen for the user/host"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound connection to *.tunnels.api.visualstudio.com or *.devtunnels.ms"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Connections to *.devtunnels.ms or tunnels.api.visualstudio.com"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTPs connection to tunnels.api.visualstudio.com"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound or inbound TFTP file transfers of ROMMON or firmware binaries"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "connection: TCP connections to ports 139/445 to multiple hosts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "connection: SMB connections to multiple internal hosts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound HTTP/S initiated by newly installed interpreter process"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "outbound connections to RMM services or to unusual destination ports"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Multiple failed connections (conn_state=REJ/S0 or history has 'R') across distinct ports from the same src_ip followed by success to a specific port."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Sequence of REJ/S0 then SF success from same src_ip within TimeWindow."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound traffic spike through formerly blocked ports/subnets following config change"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New egress to Internet by the same UID/host shortly after terminal exec"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "connection: Inbound connections to SSH or VPN ports"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "External access to container ports (2375, 6443)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "remote access"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound Connections"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "connection attempts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "outbound connections from host during or immediately after image build"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "new outbound connection from browser/office lineage"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "new outbound connection from exploited lineage"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Multiple failed connections to closed ports (history contains 'R' or conn_state in {REJ, S0}) followed by a successful handshake to a new port from same src within TimeWindowKnock"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Closed-port hits followed by success from same src_ip"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected inbound/outbound TFTP traffic for device image files"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services"
                },
                {
                    "name": "snmp:access",
                    "channel": "GETBULK/GETNEXT requests for OIDs associated with configuration parameters"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Bits-Client/Operational",
                    "channel": "BITS job lifecycle events such as job create/modify/transfer/complete and URL/remote name fields"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-WLAN-AutoConfig",
                    "channel": "EventCode=8001, 8002, 8003"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=5156, 5157"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; process-to-broker connection"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; connection to DNS/DoH destination with process identity"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; Python-originated connection to OT or external destination"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3, 22"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=8001"
                },
                {
                    "name": "android:EnterpriseNetworkLog",
                    "channel": "DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata"
                },
                {
                    "name": "iOS:NetworkExtension",
                    "channel": "NEFilterFlow / per-app VPN / secure-web-gateway flow metadata"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "device establishes new network connections or activates protocols not seen in pre-reboot baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): firmware updater connecting to device on firmware port, by User Identifier (UID) not in authorized firmware manager UIDs, outside maintenance window schedule"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect() syscall on port (e.g., 80, 443, 8080, etc.) to destination not in approved vendor domains, from Industrial Control Systems (ICS) service process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 to device subnet within auth-to-device window of the anomalous logon"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on port 80/443/8080 from process not matching Industrial Control Systems (ICS) vendor update process allowlist"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 from resulting process to destinations not in approved destinations list"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 to device subnet from process not in authorized Industrial Control Systems (ICS) applications"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0055",
                    "external_id": "DC0055"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:44.861Z",
            "name": "File Access",
            "description": "To events where a file is opened or accessed, making its contents available to the requester. This includes reading, executing, or interacting with files by authorized or unauthorized entities. Examples include logging file access events (e.g., Windows Event ID 4663), monitoring file reads, and detecting unusual file access patterns. Examples: \n\n- File Read Operations: A user opens a sensitive document (e.g., financial_report.xlsx) on a shared drive.\n- File Execution: A script or executable file is accessed and executed (e.g., malware.exe is run from a temporary directory).\n- Unauthorized File Access: An unauthorized user attempts to access a protected configuration file (e.g., `/etc/passwd` on Linux or `System32` files on Windows).\n- File Access Patterns: Bulk access to multiple files in a short time (e.g., mass access to documents on a file server).\n- File Access via Network: Files on a network share are accessed remotely (e.g., logs of SMB file access).",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "android:logcat",
                    "channel": "READ or COPY operations where path matches external/shared locations of other apps (e.g., /storage/emulated/0/Android/data/<otherpkg>/files/, /storage/emulated/0/Download/<app>/*)"
                },
                {
                    "name": "android:logcat",
                    "channel": "KeyChain/AndroidKeyStore read of token alias"
                },
                {
                    "name": "android:logcat",
                    "channel": "READ/LIST/STAT of /sdcard|/storage/emulated/0|/Android/media|/Documents with >N distinct paths in TimeWindow"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "/home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "/proc/*/mem read attempt"
                },
                {
                    "name": "auditd:FS",
                    "channel": "read: File access to /proc/modules or /sys/module/"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini)"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "PATH"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "file read"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, read, or stat of browser config files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open: File access attempt on /tmp/krb5cc_* or /tmp/krb5.ccache"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "openat"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, read"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, flock, fcntl, unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "read/open of sensitive files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Unusual processes accessing or modifying cookie databases"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "PATH records referencing /dev/video*"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Processes reading credential or token cache files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "read/open of sensitive file directories"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read of sensitive config or secret files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read of sensitive directories"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read: Access to /proc/self/status with focus on TracerPID field"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read access to ~/.bash_history"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open,read"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read system calls to ~/.bash_history or /etc/shadow"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "read of /run/secrets or docker volumes by non-entrypoint process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open or read to browser cookie storage"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, read, mount"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "file"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read of sensitive directories (/etc, /home/*)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "PATH"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/read on ~/.local/share/keepassxc/* OR ~/.password-store/*"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "attempts to read /proc/* entries at scale (openat/getdents64/readlink) or access denied for /proc traversal; correlate to app UID"
                },
                {
                    "name": "azure:activity",
                    "channel": "CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows"
                },
                {
                    "name": "CloudTrail:GetObject",
                    "channel": "sensitive credential files in buckets or local image storage"
                },
                {
                    "name": "desktop:file_manager",
                    "channel": "nautilus, dolphin, or gvfs logs"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "container_file_activity"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "open/read on secret mount paths"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "datastore file access"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "read: Access to sensitive log files by non-admin users"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "datastore/log file access"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "vSphere File API Access"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "file copy or datastore upload via HTTPS"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "guest OS outbound transfer logs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "VMFS access logs"
                },
                {
                    "name": "esxis:vmkernel",
                    "channel": "Datastore Access"
                },
                {
                    "name": "File",
                    "channel": "None"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "file system events indicating access to system configuration files and environmental information sources"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "File Access Monitor"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "Disk Activity Tracing"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "filesystem activity"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "Filesystem Call Monitoring"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "read/write"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file open for known browser cookie paths"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file reads/writes from /Volumes/"
                },
                {
                    "name": "fs:quarantine",
                    "channel": "/var/log/quarantine.log"
                },
                {
                    "name": "gcp:audit",
                    "channel": "Write operations to storage"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "READ operations from App Group containers (/var/mobile/Containers/Shared/AppGroup/...) or Files/Photos provider mountpoints, especially when group not owned by bundle"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "readdir/stat/read of /private/var/mobile/Containers/Shared/AppGroup|/Library/Mobile Documents|/On\\\\ My\\\\ iPhone with >N distinct paths in TimeWindow"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server"
                },
                {
                    "name": "linux:osquery",
                    "channel": "/proc/*/maps access"
                },
                {
                    "name": "linux:osquery",
                    "channel": "None"
                },
                {
                    "name": "linux:syslog",
                    "channel": "auth.log or custom tool logs"
                },
                {
                    "name": "linux:syslog",
                    "channel": "/var/log/syslog"
                },
                {
                    "name": "linux:syslog",
                    "channel": "kernel messages related to cryptographic operations, module loading, and filesystem access patterns"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileAccessed, MailboxAccessed"
                },
                {
                    "name": "m365:unified",
                    "channel": "Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365)"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "open or read syscall to ~/.bash_history"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "es_event_open, es_event_exec"
                },
                {
                    "name": "macos:keychain",
                    "channel": "Access to Keychain DB or system.keychain"
                },
                {
                    "name": "macos:keychain",
                    "channel": "~/Library/Keychains, /Library/Keychains"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "None"
                },
                {
                    "name": "macOS:unifiedlog",
                    "channel": "looking for file access to scripts with abnormal encoding patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Access to ~/Library/*/Safari or Chrome directories by non-browser processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Kerberos framework calls to API:{uuid} cache outside normal process lineage"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Read access to Time Machine plist files or CCC configurations in ~/Library/Preferences/"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream - file subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file read of sensitive directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Abnormal process access to Safari or Chrome cookie storage"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "open: Access to /var/log/system.log or related security event logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "open/read of *.plist or .env files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "read of user document directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "read access to ~/Library/Keychains/login.keychain-db"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "filesystem and process events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "read access to ~/Library/Keychains or history files by terminal processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "access to /Volumes/SharePoint or network mount"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Access to ~/Library/Safari/Bookmarks.plist or recent files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "access to keychain database"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream - file provider subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "read/write of user documents prior to upload"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "open/read access to private key files (id_rsa, *.pem, *.p12)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "read: File access to /System/Library/Extensions/ or related kernel extension paths"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "*.opvault OR *.ldb OR *.kdbx"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Recent download opened or executed"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application reads multiple local container files, browser-history artifacts, messaging artifacts, or local records in rapid sequence during the collection phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application performs burst reads across local system paths, external storage, media directories, cache locations, or local database files within a short interval as the primary collection phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application loads executable or library from external or writable directory (e.g., /sdcard/, app cache) prior to execution"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Windows Defender/Operational",
                    "channel": "Suspicious file execution on removable media path"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on path IN /sdcard/ OR on path with file_permissions=777"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir() or File.listFiles() on path IN $ExternalStoragePaths$ called > $FileEnumThreshold$ times within $EnumWindow$ by app NOT IN $FileEnumAllowList$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() for read on /proc/cpuinfo"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across $MinDirectoryCount$+ distinct parent directories with file_read_count > $FileReadRateThreshold$ within $DataCollectionWindow$ in background or low-interaction state — bulk cross-directory read is the collection signal"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads multiple files from Photos library, Files provider, or iCloud Drive in background or lock-adjacent state exceeding $FileReadRateThreshold$ within $DataCollectionWindow$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App loads executable or library from writable external directory (/sdcard/, app cache, /data/local/tmp/) — writable-path library load is exploitable hijack vector"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing/SACL): Siemens engineering process reads/opens project file from unapproved repository/removable-media/network-share path"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0039",
                    "external_id": "DC0039"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:40.408Z",
            "name": "File Creation",
            "description": "A new file is created on a system or network storage. This action often signifies an operation such as saving a document, writing data, or deploying a file. Logging these events helps identify legitimate or potentially malicious file creation activities. Examples include logging file creation events (e.g., Sysmon Event ID 11 or Linux auditd logs). ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$"
                },
                {
                    "name": "android:logcat",
                    "channel": "App UID writes new file with suspicious extension/location (.tmp, .dat, .enc, /data/data/<pkg>/files/, /sdcard/Download/) and high estimated entropy"
                },
                {
                    "name": "android:logcat",
                    "channel": "App UID writes edited media to container paths (e.g., /data/data/<pkg>/files/, .../cache/, /storage/emulated/0/Pictures/<pkg>/) with high delta in size vs. original and elevated estimated segment entropy  "
                },
                {
                    "name": "android:logcat",
                    "channel": "Create/write of high-entropy files in /data/data/<pkg>/(files|cache)/ or /storage/emulated/0/<...> with .dex/.so/.jar/.tmp/.bin"
                },
                {
                    "name": "android:logcat",
                    "channel": "Create/write under /data/data/<pkg>/(files|cache)/ or /storage/emulated/0/ with extension .dex/.jar/.so/.zip/.tmp/.js and elevated entropy"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE of archive or container (.zip/.gz/.7z/.db copy) that aggregates files pulled from other-package paths"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE to app-writable DB/file path indicating clipboard dump (e.g., clipboard.db, clip_*.txt)"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE paths like /data/data/<pkg>/files/(keys|inputs)/.*\\\\.db|\\\\.txt|\\\\.log"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE to /data/data/<pkg>/(files|databases)/(keys|inputs|clipboard).*\\\\.(db|sqlite|txt|log)"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE to /data/data/<pkg>/(files|databases)/(creds|form|prompt).*\\\\.(db|sqlite|json|txt)"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE /data/data/<pkg>/(files|databases)/(app_inventory|pkg_list).*\\\\.(json|txt|db)"
                },
                {
                    "name": "android:logcat",
                    "channel": "CREATE/WRITE /data/data/<pkg>/(files|databases)/(security_inventory|policy_audit).*\\\\.(json|txt|db|plist)"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "File creation with name starting with '.'"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "create: New file created in system binaries or temp directories"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "create: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "create: Creation of archive files in /tmp, /var/tmp, or user home directories"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "create: Creation of files with anomalous headers and entropy levels in /tmp or user directories"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "Creation of hidden files (.*) in sensitive directories (/etc, /var, /usr/bin)"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "Creation of files with extensions .sql, .csv, .sqlite, especially in user directories"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "mount target path within /proc/*"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "creation of .so files in non-standard directories (e.g., /tmp, /home/*)"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "creat"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open or creat syscalls targeting excluded paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "file creation/modification"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write/open, FIM audit"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open: Write to ~/.vscode-cli/code_tunnel.json"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, unlink, rename: File creation or deletion involving critical stored data"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "creat, open, write on /etc/systemd/system and /usr/lib/systemd/system"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write, open, or rename to /etc/systemd/system/*.service"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "File creations of *.qcow2, *.vdi, *.vmdk outside standard VM directories"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write, unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "File creation events in /var/mail or /var/spool/mail exceeding baseline thresholds"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write or create file after .bash_history access"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "new file created in /var/www/html, /srv/http, or similar web root"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Access or modification to /lib/modules or creation of .ko files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open,create"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open,creat,rename,write"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "PutObject"
                },
                {
                    "name": "CloudTrail:PutObject",
                    "channel": "PutObject"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "file write"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "VMFS file creation"
                },
                {
                    "name": "File",
                    "channel": "None"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "creat"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "create/write/rename in user-writable paths"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "Directory events (kFSEventStreamEventFlagItemCreated)"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "open/write/exec calls"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "disk activity on /Library/LaunchAgents or LaunchDaemons"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "File IO"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file activity"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file open/write"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "create: Attachment file creation in ~/Library/Mail directories"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "write or chmod to ~/Library/LaunchAgents/*.plist"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file write"
                },
                {
                    "name": "fs:launchdaemons",
                    "channel": "file_create"
                },
                {
                    "name": "gcp:workspaceaudit",
                    "channel": "drive.activity logs"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "NSFileHandle/NSFileManager writes creating high-entropy files within app container (/var/mobile/Containers/Data/Application/<GUID>/tmp|Library/Caches)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Create/write of high-entropy Mach-O/bundle or generic blob in /var/mobile/Containers/Data/Application/<GUID>/(tmp|Library/Caches)/"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Create/write in /var/mobile/Containers/Data/Application/<GUID>/(tmp|Library/Caches)/ for .js/.bundle/.dylib/.zip with elevated entropy"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE of archive/container (.zip/.gz/.7z/.db export) aggregating recently read items"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE of clipboard dump artifacts in container (clipboard.db, clip_*.txt, caches)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE clipboard/keylog artifacts (clipboard.db, keys_*.txt) in container"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE of keylog artifacts (keys_*.txt, inputs.db) within app/keyboard container"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE of form cache/credential-like artifacts (forms.db, creds.json) in container"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE container paths like /Library/Caches/app_inventory.*\\\\.(json|plist|db)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "CREATE/WRITE of /Library/Caches/security_inventory.*\\\\.(json|plist|db)"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "es_event_open"
                },
                {
                    "name": "macos:fsevents",
                    "channel": "/Library/StartupItems/, ~/Library/LaunchAgents/"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CREATE/MODIFY: Modification of app.asar inside .app bundle"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file write"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation or modification of browser extension .plist files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file creation in AV exclusion directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file write/create"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of .plist under /Library/Managed Preferences/"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "creation of ~/.vscode-cli/code_tunnel.json"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "create/modify dylib files in monitored directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File created in ~/Library/LaunchAgents or executable directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process wrote large .mov/.mp4 in user temp/hidden dirs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "logd:file write"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File creation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Attachment files written to ~/Downloads or temporary folders"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Writes of .sql/.csv/.xlsx files to user documents/downloads"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File Events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation or modification of postinstall scripts within .pkg or .mpkg contents"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "create: New files in /tmp or ~/Library/Application Support/* with executable or script extensions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File creation of unsigned binaries/scripts in user cache or download directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of files with anomalous headers and entropy values"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of .zip or .dmg files in user-accessible or temporary directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file create or modify in /etc/emond.d/rules or /private/var/db/emondClients"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Browser/WebView process creates downloaded payloads, temporary files, dropped archives, or unusual cached web artifacts shortly after visiting external content"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "File writes from removable-media or USB-associated paths into download, package staging, temp, or application-accessible storage shortly after USB connection"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "large file write originating from /mnt/usb or external mounted storage"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Recently installed or updated trusted app writes staging, cache, buffer, or export artifacts inconsistent with its approved function, especially when temporally adjacent to sensitive resource access or outbound transfer"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App stages, buffers, caches, or exports data locally immediately before communication with legitimate external web-service endpoints in a way inconsistent with normal sync or offline workflow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Burst write to cache, buffer, temp, staging, or export path occurred between inbound retrieval and outbound write to same public web-service class"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Burst write to media, cache, temp, export, or staging path occurred during or immediately after camera session from same app identity"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App writes encoded/encrypted blobs (high entropy data) to local storage or memory buffers prior to transmission"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App writes high-entropy encrypted blobs to local storage or memory buffers prior to transmission"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App writes asymmetric-encrypted blobs or encoded ciphertext to local buffers or files prior to transmission"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application reads multiple user-data files, media objects, message stores, or app-private records in burst sequence immediately before packaging or encryption activity"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application writes archive-like container or high-entropy packaged blob to app storage, cache, temp path, or shared external path after burst collection activity"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application writes new large container, temp package, or high-entropy blob after clustered local data access and before outbound communication"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application performs burst reads across local system paths, external storage, media directories, cache locations, or local database files within a short interval as the primary collection phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application writes newly retrieved binary, archive, script-like asset, overlay content, library, or opaque payload to app-private, cache, temp, or shared external path as the primary local effect of transfer"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Managed app writes newly retrieved container-local asset, dylib-like resource, archive, or opaque payload shortly after remote retrieval as the strongest local effect"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "APK, DEX, native library, or package-associated executable content is written, expanded, or swapped in app package paths, staging paths, or installer cache immediately before or during application replacement"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application modifies protected configuration, local control files, security settings, or tool-related data immediately before security service degradation or non-reporting state"
                },
                {
                    "name": "snmp:syslog",
                    "channel": "firmware write/log event"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Shell-Core",
                    "channel": "New startup folder shortcut or binary placed in Startup directory"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "File creation of suspicious scripts/binaries in temporary directories"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: Local file write between inbound retrieval"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on path LIKE '/data/data/%/files/%' for binary or dex content by app_package NOT IN $LegitDynamicLoaders$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT on binary-typed path in /data/data/<app>/ within $StegoExecWindow$ of media file download from same session"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data/<app>/files/ within $AudioCaptureWindow$ of recording API start"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ by browser process within $DriveByWindow$ — payload drop confirms exploit code execution"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with installer_source NOT IN $ApprovedInstallSources$ within $PolicyViolationWindow$ of settings change"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device with signing certificate matching manually-trusted enterprise cert NOT IN $EnterpriseCertAllowList$ within $ProfileInstallWindow$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() with signing_cert NOT IN $EnterpriseCertList$ within $PolicyViolationWindow$ of settings change"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: IPA binary written with signing cert matching user-trusted certificate NOT IN $EnterpriseCertList$ within $ProfileInstallWindow$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app binary written to device storage as part of install — confirms impersonating app is being persisted"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: PackageInstaller.install() writes binary to device storage for impersonating app — install event is the enrollment of impersonating app"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for APK file in /sdcard/ or /data/local/tmp/ within $PhishingWindow$ of navigation to flagged URL — APK drop confirms malware delivery phase"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App stages or caches content retrieved from web-service platform locally before initiating secondary network connection"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes high-entropy blob (Shannon entropy > $EntropyThreshold$) to local staging path immediately before outbound transmission — encrypted staging artifact confirms app-layer encryption occurred"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes newly retrieved binary, archive, native library (.so), DEX, or script to /data/data/<app>/files/, cache, or shared storage within $IngressWriteWindow$ of network retrieval from non-CDN source"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: Managed app writes newly retrieved container-local file, dylib-like resource, or opaque payload after download from non-CDN source"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: APK, DEX, or native library written to app installation path outside MDM-authorized update mechanism — binary replacement is the persistence artifact"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes to or modifies protected configuration files or local control structures of deployed security tools"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 with executable/script extension from remote-sourced write operation"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 by same process within capture to file window of the Application Programming Interface (API) call"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 to alarm threshold config path by image not in Human-Machine Interface (HMI) alarm parent allowlist"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0085",
                    "external_id": "DC0085"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:41.384Z",
            "name": "Network Traffic Content",
            "description": "The full packet capture (PCAP) or session data that logs both protocol headers and payload content. This allows analysts to inspect command and control (C2) traffic, exfiltration, and other suspicious activity within network communications. Unlike metadata-based logs, full content analysis enables deeper protocol inspection, payload decoding, and forensic investigations.\n\n*Data Collection Measures:*\n\n- Network Packet Capture (Full Content Logging)\n    - Wireshark / tcpdump / tshark\n        - Full packet captures (PCAP files) for manual analysis or IDS correlation. `tcpdump -i eth0 -w capture.pcap`\n    - Zeek (formerly Bro)\n        - Extracts protocol headers and payload details into structured logs. `echo \"redef Log::default_store = Log::ASCII;\" > local.zeek | zeek -Cr capture.pcap local.zeek`\n    - Suricata / Snort (IDS/IPS with PCAP Logging)\n        - Deep packet inspection (DPI) with signature-based and behavioral analysis. `suricata -c /etc/suricata/suricata.yaml -i eth0 -l /var/log/suricata`\n- Host-Based Collection\n    - Sysmon Event ID 22 – DNS Query Logging, Captures DNS requests made by processes, useful for detecting C2 domains.\n    - Sysmon Event ID 3 – Network Connection Initiated, Logs process-to-network connection relationships.\n    - AuditD (Linux) – syscall=connect, Monitors outbound network requests from processes. `auditctl -a always,exit -F arch=b64 -S connect -k network_activity`\n- Cloud & SaaS Traffic Collection\n    - AWS VPC Flow Logs / Azure NSG Flow Logs / Google VPC Flow Logs, Captures metadata about inbound/outbound network traffic.\n    - Cloud IDS (AWS GuardDuty, Azure Sentinel, Google Chronicle), Detects malicious activity in cloud environments by analyzing network traffic patterns.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "NSM:Content",
                    "channel": "Pub/sub protocol, client ID, topic/queue and message metadata when observable"
                },
                {
                    "name": "ALB:HTTPLogs",
                    "channel": "AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts"
                },
                {
                    "name": "apache:access_log",
                    "channel": "Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders"
                },
                {
                    "name": "API:ConfigRepoAudit",
                    "channel": "Access to configuration repository endpoints, unusual enumeration requests or mass downloads"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "setsockopt, ioctl modifying ARP entries"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Traffic between instances"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Large volume of malformed or synthetic payloads to application endpoints prior to failure"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "High volume internal-to-internal IP transfer or cross-account cloud transfer"
                },
                {
                    "name": "azure:activity",
                    "channel": "networkInsightsLogs"
                },
                {
                    "name": "azure:vpcflow",
                    "channel": "HTTP requests to 169.254.169.254 or Azure Metadata endpoints"
                },
                {
                    "name": "container:proxy",
                    "channel": "outbound/inbound network activity from spawned pods"
                },
                {
                    "name": "docker:events",
                    "channel": "remote API calls to /containers/create or /containers/{id}/start"
                },
                {
                    "name": "docker:stats",
                    "channel": "unusual network TX/RX byte deltas"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "Process within container accesses link-local address 169.254.169.254"
                },
                {
                    "name": "EDR:hunting",
                    "channel": "Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents"
                },
                {
                    "name": "esxcli:network",
                    "channel": "Socket sessions with randomized payloads inconsistent with TLS"
                },
                {
                    "name": "esxcli:network",
                    "channel": "listening sockets bound to non-standard ports"
                },
                {
                    "name": "esxcli:network",
                    "channel": "listening sockets bound with non-standard encapsulated protocols"
                },
                {
                    "name": "esxcli:network",
                    "channel": "Socket inspection showing RSA key exchange outside baseline endpoints"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Network activity"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Outbound traffic using encoded payloads post-login"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "HTTPS POST connections to webhook endpoints"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Inspection of sockets showing encrypted sessions from non-baseline processes"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "HTTPS POST connections to pastebin-like domains"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "network stack module logs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Suspicious traffic filtered or redirected by VM networking stack"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "VMCI syslog entries"
                },
                {
                    "name": "esxi:vob",
                    "channel": "NFS/remote access logs"
                },
                {
                    "name": "etw:Microsoft-Windows-NDIS-PacketCapture",
                    "channel": "TLS Handshake/Network Flow"
                },
                {
                    "name": "etw:Microsoft-Windows-WinINet",
                    "channel": "HTTPS Inspection"
                },
                {
                    "name": "etw:Microsoft-Windows-WinINet",
                    "channel": "WinINet API telemetry"
                },
                {
                    "name": "gcp:audit",
                    "channel": "network.query*"
                },
                {
                    "name": "gcp:vpcflow",
                    "channel": "first 5m egress to unknown ASNs"
                },
                {
                    "name": "IDS:TLSInspection",
                    "channel": "Malformed certs, incomplete asymmetric handshakes, or invalid CAs"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Per-app VPN flow logging indicating opaque/archived payload transfer preceding local decode"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Per-App VPN flow with code-like content types (application/octet-stream, application/zip, text/javascript, application/x-mach-o)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "WKWebView navigation to domain visually similar to target brand (IDN/punycode/alike score)"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Query to suspicious domain with high entropy or low reputation"
                },
                {
                    "name": "linux:syslog",
                    "channel": "curl|wget|python .*http"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Unexpected SQL or application log entries showing tampered or malformed data"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Integrity mismatch warnings or malformed packets detected"
                },
                {
                    "name": "linux:syslog",
                    "channel": "DNS response IPs followed by connections to non-standard calculated ports"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Multiple NXDOMAIN responses and high entropy domains"
                },
                {
                    "name": "m365:office",
                    "channel": "External HTTP/DNS connection from Office binary shortly after macro trigger"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process + network metrics correlation for bandwidth saturation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "DNS query with pseudo-random subdomain patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "network flow"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "curl|osascript.*open location"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem: com.apple.network"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "open URL|clicked link|LSQuarantineAttach"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Connections to suspicious domains with mismatched certificate or unusual patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "HTTP POST with encoded content in user-agent or cookie field"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream (subsystem: com.apple.system.networking)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Encrypted connection with anomalous payload entropy"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Rapid incoming TLS handshakes or HTTP requests in quick succession"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "network, socket, and http logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "DNS responses followed by connections to ports outside standard ranges"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Persistent outbound traffic to mining domains"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Encrypted session initiation by unexpected binary"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "eventMessage = 'promiscuous'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "outbound HTTPS connections to code repository APIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "eventMessage = 'open', 'sendto', 'connect'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dns-sd, mDNSResponder, socket activity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process + network activity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.WebKit"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem: com.apple.WebKit or com.apple.WebKit.Networking"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "encrypted outbound traffic carrying unexpected application data"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Persistent outbound connections with consistent periodicity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "TLS connections with abnormal handshake sequence or self-signed cert"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Web server process initiating outbound TCP connections not tied to normal server traffic"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "outbound TLS connections to cloud storage providers"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "outbound HTTPS connections to cloud storage APIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process, network"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process = 'ssh' OR eventMessage CONTAINS 'ssh'"
                },
                {
                    "name": "Netfilter/iptables",
                    "channel": "Forwarded packets log"
                },
                {
                    "name": "Network Traffic",
                    "channel": "None"
                },
                {
                    "name": "networkconfig ",
                    "channel": "interface flag PROMISC, netstat | ip link | ethtool"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "NAT table modification (add/update/delete rule)"
                },
                {
                    "name": "NetworkDevice:IDS",
                    "channel": "DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures"
                },
                {
                    "name": "networkdevice:IDS",
                    "channel": "content inspection / PCAP / HTTP body"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "ACL/Firewall rule modification or new route injection"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "config change (e.g., logging buffered, pcap buffers)"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Authentication failures or unusual community string usage in SNMP queries"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Symmetric encryption detected without TLS handshake sequence"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "TLS handshake + HTTP headers"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Abnormal certificate chains or non-standard ports carrying TLS"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Unusual POST requests to admin or upload endpoints"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Outbound connections to internal enterprise services exhibiting anomalous protocol behavior, malformed sessions, or exploit-consistent traffic patterns"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable"
                },
                {
                    "name": "NSM:Content",
                    "channel": "MQTT/AMQP/DDS protocol and message metadata when visible"
                },
                {
                    "name": "NSM:Content",
                    "channel": "MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible"
                },
                {
                    "name": "NSM:Content",
                    "channel": "SSL Certificate Metadata"
                },
                {
                    "name": "NSM:Content",
                    "channel": "HTTP Header Metadata"
                },
                {
                    "name": "NSM:Content",
                    "channel": "TLS Fingerprint and Certificate Analysis"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Traffic on RPC DRSUAPI"
                },
                {
                    "name": "NSM:DNS",
                    "channel": "Native DNS query/response content: long/encoded labels, TXT use, unusual query structure"
                },
                {
                    "name": "NSM:DNS",
                    "channel": "Native DNS query/response content"
                },
                {
                    "name": "NSM:DNS",
                    "channel": "DNS query/response metadata and content"
                },
                {
                    "name": "NSM:DNS",
                    "channel": "Device DNS query/response content"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "TLS/HTTP inspection"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "Anomalous TCP SYN or ACK spikes from specific source or interface"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "Outbound encrypted traffic"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "ICMP/UDP protocol anomaly"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "mqtt.log / xmpp.log (custom log feeds)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "mqtt.log or AMQP custom log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "mqtt.log, xmpp.log, amqp.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TCP/UDP"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TCP session tracking"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Captured packet payloads"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "session behavior"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "External C2 channel over TLS"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http/file-xfer: Inbound/outbound transfer of ELF shared objects"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log, files.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "unexpected network activity initiated shortly after shell session starts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log, ssl.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log, conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "SPAN or port-mirrored HTTP/S"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log, ssl.log, websocket.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Browser connections to known C2 or dynamic DNS domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Session History Reset"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP "
                },
                {
                    "name": "NSM:Flow",
                    "channel": "query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP/TLS Logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Suspicious URL patterns, uncommon TLDs, URL shorteners"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Suspicious GET/POST; downloader patterns"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "SSH logins or scp activity"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "remote login and transfer"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Suspicious long-lived or reattached remote desktop sessions from unexpected IPs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP payloads with SQLi/LFI/JNDI/deserialization indicators"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "outbound egress from web host after suspicious request"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Requests towards cloud metadata or command & control from pod IPs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Connections to TCP 427 (SLP) or vCenter web services from untrusted sources"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "NetFlow/sFlow for odd egress to Internet from mgmt plane"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "packet capture or DPI logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "SMB2_LOGOFF/SMB_TREE_DISCONNECT"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unusual Base64-encoded content in URI, headers, or POST body"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Base64 strings or gzip in URI, headers, or POST body"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound to 22/5900/8080 and follow-on internal connections."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: HTTP body contains long Base64 sections"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: Base64/MIME looking payloads from ESXi host IP"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "LDAP Bind/Search"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "LDAP Query"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "smtp.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "smtp.log, conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "remote CLI session detection"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.log, ftp.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "PCAP inspection"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large HTTPS POST requests to webhook endpoints"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large upload to firmware interface port or path"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log + http.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http/file-xfer: Outbound transfer of large video-like MIME types soon after capture"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound SCP, TFTP, or FTP sessions carrying configuration file content"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Session Transfer Content"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Captured File Content"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "C2 exfiltration"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Transferred file observations"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http::post: Outbound HTTP POST from host shortly after DB export activity"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Observed downgrade in negotiated cipher suites or TLS/SSH versions across sessions"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http::request: Network connection to package registry or C2 from interpreter shortly after install"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http::request: Outbound HTTP initiated by Python interpreter"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large HTTPS POST requests to text storage domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected ARP replies or DNS responses inconsistent with authoritative servers"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TLS downgrade or inconsistent DNS answers"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log or http.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "dns: DNS labels with excessive length and restricted custom alphabets (e.g., base36 only) repeated frequently"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: suspicious long tokens with custom alphabets in body/headers"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http: HTTP bodies from ESXi host IPs containing long, non-standard tokens"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Egress to non-approved networks from host after terminal exec"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Flow/PCAP analysis for outbound payloads"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log + files.log + ssl.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTPS or custom protocol traffic with large payloads"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected script or binary content returned in HTTP response body"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Injected content responses with unexpected script/malware signatures"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Content injection observed in HTTPS responses with mismatched certificates or altered payloads"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Relay patterns across IP hops"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ldap.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Probe responses from unauthorized APs responding to client probe requests"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Excessive gratuitous ARP replies on local subnet"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inbound HTTP POST with suspicious payload size or user-agent"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "POST requests to .php, .jsp, .aspx files with high entropy body"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "dns.log"
                },
                {
                    "name": "NSM:FLow",
                    "channel": "dns.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Encrypted tunnels or proxy traffic to non-standard destinations"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large transfer from management IPs to unauthorized host"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ftp.log, smb_files.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ftp.log, conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "mirror/SPAN port"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ftp.log, conn.log, smb_files.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "SSL/TLS Inspection or PCAP"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log, ssl.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "http, dns, smb, ssl logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "dns, ssl, conn"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log, http.log, dns.log, ssl.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ICMP/UDP traffic (Wireshark, Suricata, Zeek)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "icmp.log, weird.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "DHCP OFFER or ACK with unauthorized DNS/gateway parameters"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Multiple DHCP OFFER responses for a single DISCOVER"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "SSL/TLS Handshake Analysis"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP Header Metadata"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Network Capture TLS/HTTP"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "container egress to unknown IPs/domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP Request Logging"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssh connections originating from third-party CIDRs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssh/smb connections to internal resources from third-party devices"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Degraded encryption throughput or switch to weaker cipher suites compared to historical baselines"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "host switch egress data"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound HTTP/S"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log - Certificate Analysis"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log, conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "ssl.log, x509.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Suspicious POSTs to upload endpoints"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TLS/HTTP download with atypical MIME (application/octet-stream, application/x-zip, application/x-gzip) followed by local decode/write"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP(S)/QUIC media download with opaque content types (image/*, audio/*, video/*) from non-gallery domains or CDNs not previously used by the app"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTP(S)/QUIC download of executable/opaque content (application/octet-stream, application/zip, application/java-archive, application/x-dex, application/x-sharedlib, text/javascript)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "burst of DNS queries/connection attempts to RFC1918 or local gateway immediately after scans"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "HTTPS sessions exhibiting periodic request cadence or structured payload exchanges inconsistent with application baseline"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Application-layer indicators observable via enterprise network controls (HTTP method, URI path pattern class, TLS SNI, JA3/ALPN when available, DNS qname/type) showing anomalous or low-and-slow command polling behavior"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Near-term increase in traffic to identity endpoints associated with SMS MFA, account recovery, or OTP verification (IdP, banking, crypto), correlated to SIM/service loss"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Abrupt shift from cellular egress to Wi-Fi-only egress, or new VPN/proxy session establishment following cellular service loss"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Application-layer web traffic showing suspicious redirect chains, iframe/ad-tech cascades, user-agent or environment fingerprinting requests, or staged payload retrieval after page visit"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Application initiates HTTPS connection with repeated certificate validation failure under enterprise proxy followed by direct network retry or stable opaque TLS communication to same endpoint within correlation window"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "App-destination pair shows consistent inspection bypass/refusal pattern followed by direct encrypted communication or repeated short-lived TLS sessions to same endpoint within correlation window"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Application retrieves remote content from non-baselined domain or IP and the transfer direction is inbound to device during the file acquisition phase"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Managed iOS app retrieves remote content from non-baselined domain or IP with inbound payload transfer during the acquisition phase"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Device shows correlated inbound session establishment followed by outbound connections to separate external destinations with overlapping timing and relay-like byte symmetry"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Traffic spike preceding control crash"
                },
                {
                    "name": "NSM:Inspection",
                    "channel": "TLS session from mobile app fails, resets, or refuses enterprise interception while same destination/app pair repeatedly establishes direct encrypted communication pattern consistent with pinned certificate/public-key validation"
                },
                {
                    "name": "NSM:Inspection",
                    "channel": "TLS handshake from iOS app repeatedly fails or is rejected only when enterprise SSL inspection certificate is presented, indicating certificate or public-key pin validation effect"
                },
                {
                    "name": "NSM:TLS/HTTP",
                    "channel": "SNI/HTTP host or resolver endpoint identification when observable"
                },
                {
                    "name": "saas:box",
                    "channel": "API calls exceeding baseline thresholds"
                },
                {
                    "name": "saas:confluence",
                    "channel": "REST API access from non-browser agents"
                },
                {
                    "name": "TelecomLogs:SS7Signaling",
                    "channel": "Subscriber information queries, routing requests, or location update messages with anomalous node identifiers or unexpected origin patterns"
                },
                {
                    "name": "TelecomLogs:SS7Signaling",
                    "channel": "Location resolution, routing, or subscriber information exchanges with anomalous signaling paths or node identities"
                },
                {
                    "name": "Traffic",
                    "channel": "None"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Supervised or newly activated device initiates outbound connections to destinations outside Apple, MDM, update, or enterprise-managed baselines while locked, with no recent user interaction, or before expected app enrollment completion"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Application or device component communicates with legitimate external web-service infrastructure such as cloud storage, social media, messaging, collaboration, paste, code-hosting, CDN-backed API, or generic HTTPS service in a pattern inconsistent with the app's approved network baseline, timing, or service class"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Supervised device or managed app communicates with legitimate external web-service infrastructure such as cloud storage, messaging, collaboration, social, paste, or generic HTTPS API platforms in a pattern inconsistent with expected service baseline, managed app role, or normal background refresh behavior"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "App-attributed HTTP GET or HTTPS session to public web platform (social, paste, collaboration, cloud storage, code-hosting) returned content followed by outbound connection to a different domain or IP within TimeWindow"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "DNS query or TLS SNI for previously unseen domain occurred within TimeWindow after session to legitimate web-service domain from same app identity"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Initial session to public web-service domain transferred small response payload followed by connection to new external endpoint with different ASN or domain category"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "App-attributed session to public web-service domain included inbound content retrieval followed by outbound POST, PUT, upload, comment, message send, document update, or API write to same service class within TimeWindow"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Repeated alternating inbound and outbound sessions to same public web-service domain or API endpoint occurred from same app identity with stable recurrence interval"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Outbound write operation to public web-service domain occurred after small inbound response retrieval from same domain or service class without preceding user-visible foreground activity"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "App-attributed HTTP GET, content fetch, sync pull, or inbound-oriented HTTPS session to public web-service domain recurred within TimeWindow without app-attributed POST, PUT, PATCH, upload, comment, message send, or API write to same service class"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Repeated app-attributed retrieval from same public web-service domain or API endpoint occurred at stable recurrence interval with low outbound volume relative to inbound content"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Inbound content retrieval from public web-service domain occurred without subsequent writeback to same service class and was followed by local or downstream activity outside normal app sync profile"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "TLS handshake, HTTP method/header pattern, or WebSocket upgrade was observed on destination port outside approved port set for detected protocol during app-attributed outbound session"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Repeated app-attributed sessions to same destination or service class used non-standard destination port with stable recurrence interval or persistent connection behavior"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Destination port was not in approved protocol-to-port mapping for app identity or service class and session did not match known enterprise proxy, relay, or developer tooling exception"
                },
                {
                    "name": "VPN:MobileProxy",
                    "channel": "Observed protocol-to-port pairing was outside approved mapping for managed bundle or service class and did not match enterprise proxy, relay, or developer tooling exception"
                },
                {
                    "name": "WebProxy:AccessLogs",
                    "channel": "SSRF-like patterns accessing metadata endpoint through proxy (e.g., Host: 169.254.169.254)"
                },
                {
                    "name": "WIDS:AssociationLogs",
                    "channel": "Unauthorized AP or anomalous MAC address connection attempts"
                },
                {
                    "name": "WinEventLog:iis",
                    "channel": "IIS Logs"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Windows Defender/Operational",
                    "channel": "Unusual external domain access"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Outbound requests with forged tokens/cookies in headers"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=5005 (WLAN), EventCode=302 (Bluetooth)"
                },
                {
                    "name": "webproxy:applog",
                    "channel": "DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed"
                },
                {
                    "name": "NSM:Content",
                    "channel": "session on firmware-capable port exceeds session size threshold from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "firmware write service targeting specific slot/rack address from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "large session on firmware-capable port from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "task/organization-block modification service from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write to existing program block address from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "download of block address not previously present in device program inventory, from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source"
                },
                {
                    "name": "NSM:Content",
                    "channel": "decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline"
                },
                {
                    "name": "NSM:Content",
                    "channel": "OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline"
                },
                {
                    "name": "dns:querylog",
                    "channel": "Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns"
                },
                {
                    "name": "NSM:Content",
                    "channel": "source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list"
                },
                {
                    "name": "zeek:ssl",
                    "channel": "Transport Layer Security (TLS) Server Name Indication (SNI) or certificate issuer does not match approved vendor domains or recognized Content Delivery Network (CDN) serving vendor content"
                },
                {
                    "name": "NSM:Content",
                    "channel": "EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "structurally valid Industrial Control System (ICS) protocol message from source not in approved communication baseline for the destination device_ip"
                },
                {
                    "name": "otids:ProtocolDecoder",
                    "channel": "SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources"
                },
                {
                    "name": "NSM:Content",
                    "channel": "read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance"
                },
                {
                    "name": "NSM:Content",
                    "channel": "mode-change service from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write to alarm threshold address range from source not in approved write sources with new value outside safe alarm threshold range"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "restart/reset service from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "firmware-update-mode activation service from source not in engineering workstation list outside change control window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write function code to same register address at rate exceeding max write rate per point within brute force detection window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources"
                },
                {
                    "name": "NSM:Content",
                    "channel": "device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential"
                },
                {
                    "name": "NSM:Content",
                    "channel": "authentication success using credential matching default vendor credential list from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "credential/access code change command from source not in approved security admin list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list"
                },
                {
                    "name": "otids:ProtocolDecoder",
                    "channel": "Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window"
                },
                {
                    "name": "otids:ProtocolDecoder",
                    "channel": "Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip"
                },
                {
                    "name": "NSM:Content",
                    "channel": "CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip"
                },
                {
                    "name": "NSM:Content",
                    "channel": "transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change"
                },
                {
                    "name": "NSM:Content",
                    "channel": "single session reads address range covering above full image coverage threshold percent of device total Input/Output (I/O) space, from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write/control method invocation from client identity not in approved application list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window"
                },
                {
                    "name": "NSM:Content",
                    "channel": "malformed or exploit-payload data via built-in communication interface from external source"
                },
                {
                    "name": "NSM:Content",
                    "channel": "vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)"
                },
                {
                    "name": "NSM:Content",
                    "channel": "deterministic function code response content diverges from the device's established per-function response baseline without a corresponding firmware update event"
                },
                {
                    "name": "NSM:Content",
                    "channel": "bulk read of configuration/data dictionary objects from source with no prior session history with this device"
                },
                {
                    "name": "NSM:Content",
                    "channel": "event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device"
                },
                {
                    "name": "NSM:Content",
                    "channel": "reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "bulk configuration/program object read from source with no prior configuration-read session history"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold"
                },
                {
                    "name": "NSM:Content",
                    "channel": "S7comm SZL Central Processing Unit (CPU)-state read or Common Industrial Protocol (CIP) Identity Object state attribute read from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "NSM:Content",
                    "channel": "S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold"
                },
                {
                    "name": "NSM:Content",
                    "channel": "online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Virtual Network Computing (VNC) connection or screen-capture Hypertext Transfer Protocol (HTTP) request to embedded Human-Machine Interface (HMI) panel from source not in approved operator workstation list"
                },
                {
                    "name": "NSM:Content",
                    "channel": "Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "otids:ProtocolDecoder",
                    "channel": "Protocol decoder/IDS transaction: traffic on an ICS service port fails expected protocol parsing/conformance or decodes as a different application protocol"
                },
                {
                    "name": "otids:ProtocolDecoder",
                    "channel": "Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly"
                },
                {
                    "name": "zeek:conn",
                    "channel": "exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0088",
                    "external_id": "DC0088"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:51.337Z",
            "name": "Logon Session Metadata",
            "description": "Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Logon Session",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4672"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "LoginWindow context with associated PID linked to reopened plist paths"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4672, 4634"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "SAML-based login with anomalous issuer or NotOnOrAfter lifetime"
                },
                {
                    "name": "m365:unified",
                    "channel": "Abnormal user claims or unexpected elevated role assignment in SAML assertion"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "authd generating multiple MFA token requests"
                },
                {
                    "name": "linux:syslog",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4624, 4625, 4768, 4769"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sssd / sudo logs"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "/var/log/hostd.log"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4778, EventCode=4779"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ssh logins or execve of remote commands"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Remote login (ssh) or screen sharing authentication attempts"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "Unauthorized container creation or kubelet exec logs"
                },
                {
                    "name": "auditd:USER_LOGIN",
                    "channel": "USER_LOGIN"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow or sshd"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4800, 4801"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4776, 4771, 4770"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve,socket,connect,openat"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Group membership change for admin or wheel"
                },
                {
                    "name": "azure:audit",
                    "channel": "Add delegated admin / Assign admin roles / Update application consent"
                },
                {
                    "name": "saas:okta",
                    "channel": "user.session.start, app.oauth2.as.authorize, policy.mfa.bypass"
                },
                {
                    "name": "gcp:audit",
                    "channel": "google.iam.credentials.generateAccessToken / serviceAccountTokenCreator"
                },
                {
                    "name": "saas:salesforce",
                    "channel": "ConnectedApp OAuth policy change / Login as user"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime"
                },
                {
                    "name": "saas:okta",
                    "channel": "user.authentication.sso"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileAccessed, SharingSet"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "UserLogin"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow, sshd"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Successful sudo or ssh from unknown IPs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow or sshd events with external IP"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process = 'sshd'"
                },
                {
                    "name": "esxi:auth",
                    "channel": "None"
                },
                {
                    "name": "vpn:authlog",
                    "channel": "Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern"
                },
                {
                    "name": "syslog:auth",
                    "channel": "authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space"
                },
                {
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account without corresponding admin-group logon in preceding session"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0032",
                    "external_id": "DC0032"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:45.184Z",
            "name": "Process Creation",
            "description": "Refers to the event in which a new process (executable) is initialized by an operating system. This can involve parent-child process relationships, process arguments, and environmental variables. Monitoring process creation is crucial for detecting malicious behaviors, such as execution of unauthorized binaries, scripting abuse, or privilege escalation attempts.. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "android:logcat",
                    "channel": "dlopen of a recently created .so OR short-lived child (/system/bin/sh,toybox,linker) spawned by app_process"
                },
                {
                    "name": "android:logcat",
                    "channel": "startActivity on top of <target_pkg> (launchMode/singleTop), task switch immediately after focus"
                },
                {
                    "name": "android:logcat",
                    "channel": "unexpected spikes in fork/exec/app process start events for helper utilities used for enumeration (ps, toybox/toolbox variants) from same UID"
                },
                {
                    "name": "AndroidLogs:Framework",
                    "channel": "Creation of a new process running as system or root UID whose executable path resides under an app container path (for example, /data/app or /data/user/0/<pkg>), or whose parent process originates from an app sandbox"
                },
                {
                    "name": "AndroidLogs:Kernel",
                    "channel": "init or zygote process executing scripts or binaries from non-standard data or sdcard locations during early boot"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "EXECVE"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execution of unexpected binaries during user shell startup"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "systemctl spawning managed processes"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of dd, shred, wipe targeting block devices"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "None"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Shell commands invoked by SQL process such as postgres, mysqld, or mariadbd"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of ssh/scp/sftp without corresponding authentication log"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of dd/sgdisk with arguments writing to sector 0 or partition table"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of dd, shred, or wipe with arguments targeting block devices"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "systemctl stop auditd, kill -9 <pid>, or modifications to /etc/selinux/config"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "cat|less|grep accessing .bash_history from a non-shell process"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve for python/python3 and script path/arguments"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve for node/nodejs or JavaScript runtime and child processes "
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve for shell/interpreter and child commands "
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve network tools"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls to soffice.bin with suspicious macro execution flags"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of systemctl or service stop"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of launchctl or pkill"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Electron-based binary spawning shell or script interpreter"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls with high-frequency or known bandwidth-intensive tools"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "process persists beyond parent shell termination"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of discovery commands targeting backup binaries, processes, or config paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of scripts or binaries spawned from browser processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "EXECVE"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of bash, python, or perl processes spawned by browser/email client"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity."
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "SYSCALL record where exe contains passwd/userdel/chage and auid != root"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of base64|openssl|xxd|python|perl with arguments matching Base64 flags"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve on code or jetbrains-gateway with remote flags"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of sleep or ping command within script interpreted by bash/python"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve or socket/connect system calls from processes using crypto libraries"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket(AF_PACKET|AF_INET, SOCK_RAW, *), setsockopt(… SO_ATTACH_FILTER|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path=\"/dev/bpf*\" (BSD/macOS-like) or setcap cap_net_raw."
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of known flash tools (e.g., flashrom, fwupd)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve, connect"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve logging for /usr/bin/systemctl and systemd-run"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of files saved in mail or download directories"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of CLI tools like psql, mysql, mongo, sqlite3"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of pip, npm, gem, or similar package managers"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "fork/exec of service via PID 1 (systemd)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: execve where exe=/usr/bin/python3 or similar interpreter"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of binaries located in /etc/init.d/ or systemd service paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Commands that alter firewall or start listeners: iptables|nft|ufw|firewall-cmd|pfctl|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw)."
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of binaries/scripts presenting false health messages for security daemons"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve, setifflags"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls for qemu-system*, kvm, or VBoxHeadless"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc."
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python*) AND cmdline matches '(curl|wget).*(\\||\\|\\s*sh|bash)|base64\\s*-d|python\\s*-c'"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Invocation of packet generation tools (e.g., hping3, nping) or fork bombs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve for proxy tools"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve or nanosleep with no stdout/stderr I/O"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of dpkg, rpm, or other package manager with list flag"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "apache2 or nginx spawning sh, bash, or python interpreter"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of commands modifying iptables/nftables to block selective IPs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve with LD_PRELOAD or linker-related environment variables set"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of re-parented process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket: Suspicious creation of AF_UNIX sockets outside expected daemons"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "systemctl enable/start: Creation/enablement of custom .service units in /etc/systemd/system"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of network stress tools or anomalies in socket/syscall behavior"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start *ssh*/*telnet*, ip route add, tcpdump, tshark)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve, unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve or socket/connect system calls for processes using RSA handshake"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: parent process is usb/hid device handler, child process bash/python invoked"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of suspicious exploit binaries targeting security daemons"
                },
                {
                    "name": "azure:vmguest",
                    "channel": "Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution"
                },
                {
                    "name": "containerd:events",
                    "channel": "New container with suspicious image name or high resource usage"
                },
                {
                    "name": "containerd:Events",
                    "channel": "unusual process spawned from container image context"
                },
                {
                    "name": "containerd:runtime",
                    "channel": "/var/log/containers/*.log"
                },
                {
                    "name": "containers:osquery",
                    "channel": "bandwidth-intensive command execution from within a container namespace"
                },
                {
                    "name": "docker:audit",
                    "channel": "Process execution events within container namespace context"
                },
                {
                    "name": "docker:events",
                    "channel": "Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "process execution or network connect from just-created container PID namespace"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "execve"
                },
                {
                    "name": "esxi:cron",
                    "channel": "process or cron activity"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "process execution across cloud VM"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "execution of esxcli with args matching 'storage', 'filesystem', 'core device list'"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "process"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "host daemon events related to VM operations and configuration queries during reconnaissance"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/root/.ash_history or /etc/init.d/*"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/var/log/shell.log"
                },
                {
                    "name": "esxi:shell",
                    "channel": "commands containing base64, openssl enc -base64, xxd -p"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/var/log/vmkernel.log, /var/log/vmkwarning.log"
                },
                {
                    "name": "esxi:shell",
                    "channel": "Shell Execution"
                },
                {
                    "name": "esxi:shell",
                    "channel": "None"
                },
                {
                    "name": "esxi:shell",
                    "channel": "commands containing long non-standard tokens or custom lookup tables"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "spawned shell or execution environment activity"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Exec"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "VMware kernel events for hardware and system configuration access during environmental validation"
                },
                {
                    "name": "esxi:vobd",
                    "channel": "/var/log/vobd.log"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "provider: ETW CreateProcess events linking msbuild.exe to suspicious children where standard logs are incomplete"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "Execution of disguised binaries"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "binary execution of security_authtrampoline"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "launchd invocation of binary from non-Apple, non-AppStore, or sideloaded location during boot or shortly after unlock"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Creation of a new process with elevated UID or sensitive entitlements whose binary path is associated with an app container or whose parent/caller is a low-privileged app/webcontent process"
                },
                {
                    "name": "kubernetes:apiserver",
                    "channel": "kubectl exec or kubelet API calls targeting running pods"
                },
                {
                    "name": "kubernetes:apiserver",
                    "channel": "exec into pod followed by secret retrieval via API"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Execution of binary resolved from $PATH not located in /usr/bin or /bin"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process_events"
                },
                {
                    "name": "linux:osquery",
                    "channel": "execution of known firewall binaries"
                },
                {
                    "name": "linux:osquery",
                    "channel": "execve: command like 'date', 'timedatectl', 'hwclock', 'cat /etc/timezone'"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Process execution with LD_PRELOAD or modified library path"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process listening or connecting on non-standard ports"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Processes linked with libssl or crypto libraries making outbound connections"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process execution events for permission modification utilities with command-line analysis"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Anomalous parent PID change"
                },
                {
                    "name": "linux:osquery",
                    "channel": "child process invoking dynamic linker post-ptrace"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socat, ssh, or nc processes opening unexpected ports"
                },
                {
                    "name": "linux:osquery",
                    "channel": "processes modifying environment variables related to history logging"
                },
                {
                    "name": "linux:syslog",
                    "channel": "KERN messages about eBPF program load/verify or LSM denials related to bpf."
                },
                {
                    "name": "linux:syslog",
                    "channel": "Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http"
                },
                {
                    "name": "linux:syslog",
                    "channel": "systemd-udevd spawning user-defined action from RUN+="
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "EventCode=1"
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "process creation events linked to container namespaces executing host-level binaries"
                },
                {
                    "name": "m365:defender",
                    "channel": "AdvancedHunting(DeviceEvents, ProcessCreate, ImageLoad, AMSI/ETW derived signals)"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec: Process execution context for loaders calling dlopen/dlsym"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC with unusual parent-child process relationships from zsh"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "es_event_exec"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec: arguments contain Base64-like strings"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec: binary == \"/usr/sbin/systemsetup\" and args contains \"-gettimezone\""
                },
                {
                    "name": "macos:endpointSecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of \"sharing -l\", \"smbutil view\", \"mount_smbfs\""
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "exec events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "processes"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process reading browser configuration paths"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Execution of non-standard binaries accessing Kerberos APIs"
                },
                {
                    "name": "macos:osquery",
                    "channel": "execve"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events OR launchd"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd or process_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes."
                },
                {
                    "name": "macos:osquery",
                    "channel": "execve: command LIKE '%systemsetup -gettimezone%' OR '%date%'"
                },
                {
                    "name": "macos:osquery",
                    "channel": "execve: Processes unexpectedly invoking Keychain or authentication APIs"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Invocation of osascript or dylib injection"
                },
                {
                    "name": "macos:osquery",
                    "channel": "query: process_events, launchd, and tcc.db access"
                },
                {
                    "name": "macos:osquery",
                    "channel": "exec"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events where path like '%tcpdump%'"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process execution monitoring for permission modification utilities with command-line argument analysis"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Execution of flooding tools or compiled packet generators"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_events table"
                },
                {
                    "name": "macos:osquery",
                    "channel": "curl, python scripts, rsync with internal share URLs"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Processes executing kextload, spctl, or modifying kernel extension directories"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Unsigned or ad-hoc signed process executions in user contexts"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process event monitoring with focus on discovery utilities and cryptographic framework usage correlation"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd, processes"
                },
                {
                    "name": "macos:osquery",
                    "channel": "execve: Unsigned or unnotarized processes launched with high privileges"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream 'eventMessage contains pubsub or broker'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process execution path inconsistent with baseline PATH directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of launchctl with suspicious arguments"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launch of Terminal.app or shell with non-standard environment setup"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process::exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Electron app spawning unexpected child process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec or spawn calls to proxy tools or torrent clients"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process launch"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --info --predicate 'subsystem == \"com.apple.cfprefsd\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of security, sqlite3, or unauthorized binaries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected applications generating outbound DNS queries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected child process of Safari or Chrome"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process writes or modifies files in excluded paths"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "com.apple.mail.* exec.*"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of memory inspection tools (lldb, gdb, osqueryi)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "background process persists beyond user logout"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec events where web process starts a shell/tooling"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec of osascript, bash, curl with suspicious parameters"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process execution logs showing discovery commands like mdfind, system_profiler, or launchctl list"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process and file events via log stream"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Browser processes launching unexpected interpreters (osascript, bash)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process:exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of osascript, bash, or Terminal initiated from Mail.app or Safari"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process activity stream"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Post-login execution of unrecognized child process from launchd or loginwindow"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process command line contains base64, -enc, openssl enc -base64"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of process launched via loginwindow session restore"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: exec + filewrite: ~/.ssh/authorized_keys"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of Java apps or other processes with hidden window attributes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process Execution"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: code or jetbrains-gateway launching with --tunnel or --remote"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'processImagePath CONTAINS \"curl\" OR \"osascript\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process using AES/RC4 routines unexpectedly"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of osascript, curl, or unexpected automation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec /usr/bin/pwpolicy"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Exec of tcpdump, rvictl, custom tools linked to libpcap.A.dylib; sysextd/systemextensionsctl events for NetworkExtension content filters."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "com.apple.firmwareupdater activity or update-firmware binary invoked"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process:launch"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of scp, rsync, curl with remote destination"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "logMessage contains pbpaste or osascript"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process launch of diskutil or system_profiler with SPStorageDataType"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Mail.app executing with parameters updating rules state"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process_name IN (\"VBoxManage\", \"prlctl\") AND command CONTAINS (\"list\", \"show\")"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec srm|exec openssl|exec gpg"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of process with DYLD_INSERT_LIBRARIES set"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process and signing chain events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchservices events for misleading extensions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchd services binding to non-standard ports"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of binaries with unsigned or anomalously signed certificates"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of Terminal, osascript, or other interpreters originating from Mail or Preview"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process start of Java or native DB client tools"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow or tccd-related entries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Command line invocation of pip3, brew install, npm install from interactive Terminal"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of ssh or sftp without corresponding login event"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launch of remote desktop app or helper binary"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected processes making network calls based on DNS-derived ports"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl spawning new processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl activity and process creation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of Python, Swift, or other binaries invoking archiving libraries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process invoking SSL routines from Security framework"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of binary listed in newly modified LaunchAgent plist"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of bless or nvram modifying boot parameters"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected processes registered with launchd"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process launch"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of curl, osascript, or unexpected Office processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Trust validation failures or bypass attempts during notarization and code signing checks"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution events for chmod, chown, chflags with unusual parameters or targets"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execve or dylib load from memory without backing file"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unusual child process tree indicating attempted recovery after crash"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of processes mimicking Apple Security & Privacy GUIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of curl, git, or Office processes with network connections"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream - process subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process execution for VBoxHeadless, prl_vm_app, vmware-vmx"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "command line or log output shows non-standard encoding routines"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execve: Helper tools invoked through XPC executing unexpected binaries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of modified binary without valid signature"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python*) AND CommandLine matches '(curl|wget).*(\\||\\|\\s*sh|bash)|base64 -D|python -c'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process created with repeated ICMP or UDP flood behavior"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Child processes of Safari, Chrome, or Firefox executing scripting interpreters"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of older or non-standard interpreters"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution events for chmod, chown, chflags with parameter analysis and target path examination"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process, socket, and DNS logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Command line containing `trap` or `echo 'trap` written to login shell files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log collect --predicate"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchd or osascript spawns process with delay command"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process:spawn"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'eventMessage contains \"exec\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of system_profiler or osascript invoking enumeration"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "httpd spawning bash, zsh, python, or osascript"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of security or osascript"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchd spawning processes tied to new or modified LaunchDaemon .plist entries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of ping, nping, or crafted network packets via bash or python to reflection services"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "System process modifications altering DNS/proxy settings"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: spawn, exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process creation events where command line = pmset with arguments affecting sleep, hibernatemode, displaysleep"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected apps performing repeated DNS lookups"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchservices or loginwindow events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of process with DYLD_INSERT_LIBRARIES set"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Suspicious Swift/Objective-C or scripting processes writing archive-like outputs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process creation with parent PID of 1 (launchd)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of diskutil or hdiutil attaching hidden partitions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected apps generating frequent DNS queries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Non-standard processes invoking financial applications or payment APIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process exec of remote-control apps or binaries with headless/connect flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of launchctl unload, kill, or removal of security agent daemons"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process activity, exec events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream process subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process:exec and kext load events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --info --predicate 'eventMessage CONTAINS \"exec\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unsigned binary execution following SIP change"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution of ssh with -L/-R forwarding flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchd or cron spawning mining binaries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Script interpreter invoked by nginx/apache worker process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of Office binaries with network activity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launch of bash/zsh/python/osascript targeting key file locations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of /sbin/emond with child processes launched"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "shutdown -h now or reboot"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of curl, rclone, or Office apps invoking network sessions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: Execution of kextstat, kextfind, or ioreg targeting driver information"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process creation involving binaries interacting with resource fork data"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process event"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "security OR injection attempts into 1Password OR LastPass"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application writes audio buffer or recorded audio file into application storage directories"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Browser or WebView-hosting application brought to foreground and navigates to external content, followed by abnormal state transition, crash, restart, or process spawn behavior"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application installed from adb, sideload, or unknown USB source"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes Runtime.exec, ProcessBuilder, JNI-backed command launcher, or equivalent command-execution bridge immediately before shell or command process creation"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Managed app invokes lower-level OS process-launch or command-execution behavior before file or network effects, including interpreter-like execution flow where visible to sensor"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application execution triggered with unexpected parent context or via indirect invocation (intent redirection or component hijack)"
                },
                {
                    "name": "OpenBSM:AuditTrail",
                    "channel": "open/openat of /dev/bpf*; ioctl BIOCSETF-like operations."
                },
                {
                    "name": "OpenBSM:AuditTrail",
                    "channel": "BSM audit events for process execution and system call monitoring during reconnaissance"
                },
                {
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:AppLocker",
                    "channel": "EventCode=8003, 8004"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-DotNETRuntime",
                    "channel": "Unexpected AppDomain creation events or anomalous AppDomainManager assembly load behavior"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4688; cmd.exe/batch execution with parent and command line "
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4688"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; Python interpreter/script execution and lineage"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; process lineage and command line"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; powershell/pwsh or suspicious parent-child chain"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1"
                },
                {
                    "name": "WinEventLog:Sysmon ",
                    "channel": "EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage "
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Application invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed launcher with sh, bash, toybox, toolbox, or su as command argument NOT IN $ApprovedShellApps$ — explicit Unix shell invocation"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Managed iOS app invokes process-launch behavior resulting in sh, bash, or equivalent shell child process on supervised device — any shell spawn on stock iOS is a jailbreak indicator"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "execve()"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "com.apple.WebKit or com.apple.WebContent process fault at level=fault within $DriveByWindow$ of navigation to flagged URL — kernel fault in WebKit subsystem is the exploit-execution signal"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "execve() of modified binary (hash != baseline) — execution of modified binary is the persistence activation"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "com.apple.WebContent or com.apple.imagent process shows unexpected child spawn or memory fault at level=fault in Unified Log — kernel fault in message-processing subsystem is exploit execution signal"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "execve() from APK installed within $PhishingWindow$ of navigation to flagged URL — first execution confirms malware activation"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "sh or cmd process spawned with arguments containing 'pm uninstall' or 'rm' by parent NOT IN $MDMAgentPackageList$ — shell invocation for destruction commands"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "kernel fault or unexpected child spawn in subsystem IN (com.apple.WebKit, com.apple.imtransferagent, com.apple.imagent) at level=fault in Unified Log"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "App invokes Runtime.exec(), ProcessBuilder.start(), or JNI-backed command execution framework to spawn shell or command interpreter process NOT IN $ApprovedShellApps$ — programmatic shell spawn is the interpreter invocation"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Managed iOS app invokes lower-level process-launch behavior or command-execution-equivalent activity outside sandbox-permitted APIs on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "App execution triggered with unexpected parent context or via indirect invocation (intent redirect, implicit intent resolution to unexpected handler) — indirect invocation path is the flow hijack confirmation"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; browser process spawns a command shell, script interpreter, or executable child inconsistent with the approved browser-child baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "System crash or unexpected halt occurring within wiper crash window of the bulk deletion event"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 firmware-update utility spawned by an account outside the authorized firmware-management set or outside the approved maintenance window"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 where a browser process spawns cmd.exe, powershell.exe, wscript.exe, or another executable outside the approved browser-child baseline"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of the newly-created file within tool transfer window of its creation"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 parent matches outlook.exe/winword.exe/excel.exe and image matches cmd.exe/powershell.exe/wscript.exe/mshta.exe on host in Industrial Control Systems (ICS) workstation inventory"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 capture utility execution from account not in approved network analysts"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0042",
                    "external_id": "DC0042"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:56.655Z",
            "name": "Drive Creation",
            "description": "The activity of assigning a new drive letter or creating a mount point for a data storage device, such as a USB, network share, or external hard drive, enabling access to its content on a host system. Examples: \n\n- USB Drive Insertion: A USB drive is plugged in and automatically assigned the letter `E:\\` on a Windows machine.\n- Network Drive Mapping: A network share `\\\\server\\share` is mapped to the drive `Z:\\`.\n- Virtual Drive Creation: A virtual disk is mounted on `/mnt/virtualdrive` using an ISO image or a virtual hard disk (VHD).\n- Cloud Storage Mounting: Google Drive is mounted as `G:\\` on a Windows machine using a cloud sync tool.\n- External Storage Integration: An external HDD or SSD is connected and assigned `/mnt/external` on a Linux system..",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "auditd:SYSCALL",
                    "channel": "mknod,open,openat"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Removable media mount notification"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "device event logs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "udev events or drive enumeration involving TinyPilot paths or device classes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Kernel Device Events - USB Block Devices"
                },
                {
                    "name": "Drive",
                    "channel": "None"
                },
                {
                    "name": "journald:systemd",
                    "channel": "udisks2 or udevd logs"
                },
                {
                    "name": "linux:osquery",
                    "channel": "mount_events"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Device attach logs containing TinyPilot/PiKVM identifiers"
                },
                {
                    "name": "linux:syslog",
                    "channel": "New HID device enumeration with type 'keyboard' followed by immediate input injection"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "mounted|appeared|DA: disk* attached"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "com.apple.diskarbitration"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Volume Mount + File Read"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Volume Mount + Process Trace + File Read"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'eventMessage contains \"USBMSC\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "New IOUSB keyboard/HID device enumerated with suspicious attributes"
                },
                {
                    "name": "macos:osquery",
                    "channel": "mount_events"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Kernel-PnP 410/400 device install, disk added"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=1006"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=1006, 10001"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=2003"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=20001 correlated with autorun registry modification within autorun modification window"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
            "created": "2022-05-11T16:22:58.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0109",
                    "external_id": "DC0109"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:51.984Z",
            "name": "Process/Event Alarm",
            "description": "This includes a list of any process alarms or alerts produced to indicate unusual or concerning activity within the operational process (e.g., increased temperature/pressure)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Databases",
                    "channel": "None"
                },
                {
                    "name": "Operational Databases",
                    "channel": "None"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "process state change recorded without preceding operator_ack or scheduled switching order reference"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "expected communication absent for device_ip without corresponding device-generated alarm explaining the gap"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--4dcd8ba3-2075-4f8b-941e-39884ffaac08",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0046",
                    "external_id": "DC0046"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-11-12T22:03:39.105Z",
            "name": "Drive Modification",
            "description": "The alteration of a drive letter, mount point, or other attributes of a data storage device, which could involve reassignment, renaming, permissions changes, or other modifications. Examples: \n\n- Drive Letter Reassignment: A USB drive previously assigned `E:\\` is reassigned to `D:\\` on a Windows machine.\n- Mount Point Change: On a Linux system, a mounted storage device at `/mnt/external` is moved to `/mnt/storage`.\n- Drive Permission Changes: A shared drive's permissions are modified to allow write access for unauthorized users or processes.\n- Renaming of a Drive: A network drive labeled \"HR_Share\" is renamed to \"Shared_Resources.\"\n- Modification of Cloud-Integrated Drives: A cloud storage mount such as Google Drive is modified to sync only specific folders.\n\nThis data component can be collected through the following measures:\n\nWindows Event Logs\n\n- Relevant Events:\n    - Event ID 98: Indicates changes to a volume (e.g., drive letter reassignment).\n    - Event ID 1006: Logs permission modifications or changes to removable storage.\n- Configuration: Enable \"Storage Operational Logs\" in the Event Viewer:\n`Applications and Services Logs > Microsoft > Windows > Storage-Tiering > Operational`\n\nLinux System Logs\n\n- Auditd Configuration: Add audit rules to track changes to mounted drives: `auditctl -w /mnt/ -p w -k drive_modification`\n- Command-Line Monitoring: Use `dmesg` or `journalctl` to observe drive modifications.\n\nmacOS System Logs\n\n- Unified Logs: Collect mount or drive modification events: `log show --info | grep \"Volume modified\"`\n- Command-Line Monitoring: Use `diskutil` to track changes:\n\nEndpoint Detection and Response (EDR) Tools\n\n- Configure policies in EDR solutions to monitor and log changes to drive configurations or attributes.\n\nSIEM Tools\n\n- Aggregate logs from multiple systems into a centralized platform like Splunk to correlate events and alert on suspicious drive modification activities.\n",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Drive",
                    "channel": "None"
                },
                {
                    "name": "networkdevice:runtime",
                    "channel": "Firmware image uploaded via TFTP/FTP/SCP"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Raw disk write access via \\\\.\\PhysicalDrive* or \\\\.\\C:"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "IOKit disk write calls targeting raw devices"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Block device write errors or unusual bootloader activity"
                },
                {
                    "name": "networkdevice:firmware",
                    "channel": "Unexpected firmware image upload events via TFTP/FTP/SCP"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Raw write attempts targeting \\\\.\\PhysicalDrive0 or sector 0 (MBR/partition table)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "IOKit raw disk write to EFI/boot partition sectors"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Raw disk writes targeting \\\\.\\PhysicalDrive* or MBR locations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "IOKit raw disk write activity targeting physical devices"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0060",
                    "external_id": "DC0060"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:53.579Z",
            "name": "Service Creation",
            "description": "The registration of a new service or daemon on an operating system.\n\n*Data Collection Measures:*\n\n- Windows Event Logs\n    - Event ID 4697 - Captures the creation of a new Windows service.\n    - Event ID 7045 - Captures services installed by administrators or adversaries.\n    - Event ID 7034 - Could indicate malicious service modification or exploitation.\n- Sysmon Logs\n    - Sysmon Event ID 1 - Process Creation (captures service executables).\n    - Sysmon Event ID 4 - Service state changes (detects service installation).\n    - Sysmon Event ID 13 - Registry modifications (captures service persistence changes).\n- PowerShell Logging\n    - Monitor `New-Service` and `Set-Service` PowerShell cmdlets in Event ID 4104 (Script Block Logging).\n- Linux/macOS Collection Methods\n    - AuditD & Syslog Daemon Logs (`/var/log/syslog`, `/var/log/messages`, `/var/log/daemon.log`)\n    - AuditD Rules:\n        - `auditctl -w /etc/systemd/system -p wa -k service_creation`\n        - Detects changes to `systemd` service configurations.\n- Systemd Journals (`journalctl -u <service_name>`)\n    - Captures newly created systemd services.\n- LaunchDaemons & LaunchAgents (macOS)\n    - Monitor `/Library/LaunchDaemons/` and `/Library/LaunchAgents/` for new plist files.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Service",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7036"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "creation or modification of systemd services"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Process Events and Launch Daemons"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7045"
                },
                {
                    "name": "linux:osquery",
                    "channel": "newly registered unit file with ExecStart pointing to unknown binary"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "creation or loading of new launchd services"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4697"
                },
                {
                    "name": "linux:syslog",
                    "channel": "systemctl start/enable with uncommon binary paths"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7031, 7034"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launch_daemons"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchd loading new LaunchDaemon or changes to existing daemon configuration"
                },
                {
                    "name": "macos:osquery",
                    "channel": "detection of new launch agents with suspicious paths or unsigned binaries"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "create"
                },
                {
                    "name": "containerLogs:systemd_unit_files",
                    "channel": "unit file referencing container binary with persistent flags"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7045 enabling Transmission Control Protocol (TCP) port forwarding on Industrial Control Systems (ICS) protocol port not in known ICS services"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0033",
                    "external_id": "DC0033"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:45.560Z",
            "name": "Process Termination",
            "description": "The exit or termination of a running process on a system. This can occur due to normal operations, user-initiated commands, or malicious actions such as process termination by malware to disable security controls.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=5"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Unexpected termination of daemons or critical services not aligned with admin change tickets"
                },
                {
                    "name": "macos:osquery",
                    "channel": "process_termination: Unexpected termination of processes tied to vulnerable or high-value services"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Log entries indicating VM powered off or forcibly terminated"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Terminal process killed (killall Terminal) immediately after sudoers modification"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "exit_group"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process.*exit.*code"
                },
                {
                    "name": "linux:osquery",
                    "channel": "unexpected termination of syslog or rsyslog processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Process segfault or abnormal termination after invoking vulnerable syscall sequence"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "kill syscalls targeting logging/security processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Termination of syspolicyd or XProtect processes"
                },
                {
                    "name": "docker:runtime",
                    "channel": "Termination of monitoring sidecar or security container"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0059",
                    "external_id": "DC0059"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:44.279Z",
            "name": "File Metadata",
            "description": "contextual information about a file, including attributes such as the file's name, size, type, content (e.g., signatures, headers, media), user/owner, permissions, timestamps, and other related properties. File metadata provides insights into a file's characteristics and can be used to detect malicious activity, unauthorized modifications, or other anomalies. Examples: \n\n- File Ownership and Permissions: Checking the owner and permissions of a critical configuration file like /etc/passwd on Linux or C:\\Windows\\System32\\config\\SAM on Windows.\n- Timestamps: Analyzing the creation, modification, and access timestamps of a file.\n- File Content and Signatures: Extracting the headers of an executable file to verify its signature or detect packing/obfuscation.\n- File Attributes: Analyzing attributes like hidden, system, or read-only flags in Windows.\n- File Hashes: Generating MD5, SHA-1, or SHA-256 hashes of files to compare against threat intelligence feeds.\n- File Location: Monitoring files located in unusual directories or paths, such as temporary or user folders.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "auditd:SYSCALL",
                    "channel": "stat and lstat syscall results on files, including inode and permission info"
                },
                {
                    "name": "AndroidLogs:Framework",
                    "channel": "BroadcastReceiver registration for android.intent.action.BOOT_COMPLETED by previously unseen or recently installed apps"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "chmod or chown of hook files indicating privilege escalation or execution permission change"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "file path matches exclusion directories"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "PATH"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "file path modifications on critical system directories (/etc, /usr/bin, /usr/sbin, /var, /opt)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "PATH"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "file write after sleep delay"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "setuid or setgid bit changes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "setxattr or getxattr system call"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/*"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "Unexpected container volume unmount + file deletion"
                },
                {
                    "name": "EDR:detection",
                    "channel": "App reputation telemetry"
                },
                {
                    "name": "EDR:file",
                    "channel": "File Metadata Inspection (Low String Entropy, Missing PDB)"
                },
                {
                    "name": "EDR:file",
                    "channel": "File Metadata Analysis (PE overlays, entropy)"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "host daemon events related to file or VM permission changes"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "Datastore file hidden or renamed unexpectedly"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Upload of file to datastore"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Storage access and file ops"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "VMware kernel events for file system permission modifications"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Datastore modification events"
                },
                {
                    "name": "File",
                    "channel": "None"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "/var/log/install.log"
                },
                {
                    "name": "fs:filesystem",
                    "channel": "Binary file hash changes outside of update/patch cycles"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "file system events indicating permission or attribute changes"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "filesystem monitoring of exec/open"
                },
                {
                    "name": "fwupd:logs",
                    "channel": "Firmware updates applied or failed"
                },
                {
                    "name": "gatekeeper/quarantine database",
                    "channel": "LaunchServices quarantine"
                },
                {
                    "name": "journald:package",
                    "channel": "dpkg/apt or yum/dnf transaction logs (install/update of build tools)"
                },
                {
                    "name": "journald:package",
                    "channel": "dpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals"
                },
                {
                    "name": "journald:package",
                    "channel": "dpkg/apt install, remove, upgrade events"
                },
                {
                    "name": "journald:package",
                    "channel": "yum/dnf install or update transactions"
                },
                {
                    "name": "linux:osquery",
                    "channel": "event-based"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events, hash"
                },
                {
                    "name": "linux:osquery",
                    "channel": "hash, elf_info, file_metadata"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "linux:osquery",
                    "channel": "elf_info, hash, yara_matches"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Read headers and detect MIME type mismatch"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events.path"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Filesystem modifications to trusted paths"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Write or modify .desktop file in XDG autostart path"
                },
                {
                    "name": "linux:osquery",
                    "channel": "hash, rpm_packages, deb_packages, file_events"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp"
                },
                {
                    "name": "linux:syslog",
                    "channel": "application or system execution logs"
                },
                {
                    "name": "linux:syslog",
                    "channel": "file permission modification events in kernel messages"
                },
                {
                    "name": "linux:syslog",
                    "channel": "kernel messages related to file system permission changes and security violations"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "es_event_file_rename_t or es_event_file_write_t"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "es_event_authentication"
                },
                {
                    "name": "macos:osquery",
                    "channel": "code_signing, file_metadata"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "mach_o_info, file_metadata"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "softwareupdated/homebrew/install logs, pkginstalld events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "AMFI or Gatekeeper signature/notarization failures for newly installed dev components"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Detection of altered _VBA_PROJECT or PerformanceCache streams"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem:syspolicyd"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File metadata updated with UF_HIDDEN flag"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Code signature validation fails or is absent post-binary modification"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Code signing verification failures or bypassed trust decisions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "filesystem events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "xattr -d com.apple.quarantine or similar attribute removal commands"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Gatekeeper quarantine policy decision anomalies recorded in com.apple.LaunchServices.QuarantineEventsV2"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "pkginstalld/softwareupdated/Homebrew install transactions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "AMFI/Gatekeeper code signature or notarization failures"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "kernel extension and system extension logs related to file system security violations or SIP bypass attempts"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected application binary modifications or altered signing status"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "extended attribute write or modification"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "New certificate trust settings added by unexpected process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.lsd"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Gatekeeper/AMFI 'code signature invalid' / 'not notarized' messages"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File creation or modification with com.apple.ResourceFork extended attribute"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "OS version query results inconsistent with expected or approved version list"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Observed File Transfers"
                },
                {
                    "name": "OpenBSM:AuditTrail",
                    "channel": "BSM audit events for file permission modifications"
                },
                {
                    "name": "OpenBSM:AuditTrail",
                    "channel": "BSM audit events for file permission, ownership, and attribute modifications with user context"
                },
                {
                    "name": "saas:RepoEvents",
                    "channel": "New file added or modified in PR targeting CI/CD or build config (e.g., `gitlab-ci.yml`, `build.gradle`, `pom.xml`, `.github/workflows/*.yml`)"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "Invalid/Unsigned image when developer tool launches newly installed binaries"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "Unsigned or invalid image for newly installed/updated binaries"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "Code integrity violations in boot-start drivers or firmware"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Windows Defender/Operational",
                    "channel": "SmartScreen or ASR blocks on newly downloaded installer/updater"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4656, 4658"
                },
                {
                    "name": "WinEventLog:Setup",
                    "channel": "MSI/Product install, repair or update events"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=15"
                },
                {
                    "name": "WinEventLog:Windows Defender",
                    "channel": "Operational log"
                },
                {
                    "name": "WinEventLog:Windows Defender",
                    "channel": "Operational"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: DEX file entropy > $PackerEntropyThreshold$ at install time for app NOT IN $MDMApprovedCatalog$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app_version in MDM == prior_version while dynamic code load from network is observed — confirms this is not a legitimate update"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: binary with file_permissions including setuid bit (mode & 04000) at path NOT IN $KnownSystemBinPaths$ — setuid outside system bin directories is the renamed-root-binary indicator"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: file hash changes for binary at $SystemBinaryPaths$ relative to known-good baseline — hash deviation confirms modification"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: MDM supervised integrity_check=fail following jailbreak detection — integrity check failure on supervised Jamf/Intune enrolled device indicates filesystem modifications beyond passive jailbreak presence"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: installed app package_name Levenshtein distance <= $NameDistanceThreshold$ to entry in $KnownAppCatalog$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: bundle_id LIKE $KnownSystemNamespace$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app package_name distance <= $NameDistanceThreshold$ from $KnownAppCatalog$ entry"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: display_name Levenshtein distance <= $NameDistanceThreshold$ from $KnownIOSAppCatalog$ entry"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources"
                },
                {
                    "name": "linux:pkgintegrity",
                    "channel": "rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary"
                },
                {
                    "name": "fim:hashcompare",
                    "channel": "installed binary hash does not match vendor-published checksum for claimed version"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share)"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--66531bc6-a509-4868-8314-4d599e91d222",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0065",
                    "external_id": "DC0065"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T15:12:00.774Z",
            "name": "Service Modification",
            "description": "Changes made to an existing service or daemon, such as modifying the service name, start type, execution parameters, or security configurations.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "esxi:hostd",
                    "channel": "service state change"
                },
                {
                    "name": "Service",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Microsoft-IIS-Configuration",
                    "channel": "Module or ISAPI filter registration events"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7040"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0064",
                    "external_id": "DC0064"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:48.219Z",
            "name": "Command Execution",
            "description": "Command Execution involves monitoring and capturing the execution of textual commands (including shell commands, cmdlets, and scripts) within an operating system or application. These commands may include arguments or parameters and are typically executed through interpreters such as `cmd.exe`, `bash`, `zsh`, `PowerShell`, or programmatic execution. Examples: \n\n- Windows Command Prompt\n    - dir – Lists directory contents.\n    - net user – Queries or manipulates user accounts.\n    - tasklist – Lists running processes.\n- PowerShell\n    - Get-Process – Retrieves processes running on a system.\n    - Set-ExecutionPolicy – Changes PowerShell script execution policies.\n    - Invoke-WebRequest – Downloads remote resources.\n- Linux Shell\n    - ls – Lists files in a directory.\n    - cat /etc/passwd – Reads the user accounts file.\n    - curl http://malicious-site.com – Retrieves content from a malicious URL.\n- Container Environments\n    - docker exec – Executes a command inside a running container.\n    - kubectl exec – Runs commands in Kubernetes pods.\n- macOS Terminal\n    - open – Opens files or URLs.\n    - dscl . -list /Users – Lists all users on the system.\n    - osascript -e – Executes AppleScript commands.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "android:logcat",
                    "channel": "Command 'pm list packages' executed by app sandbox or child proc"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "udev rule reload or trigger command executed"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve of script/interpreter (bash, python, node) with suspicious encoded or non-printable content"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Use of mv or cp to rename files with '.' prefix"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve: Execution of update-ca-certificates or trust anchor modification commands"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "gcore, gdb, strings, hexdump execution"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of auditctl, systemctl stop auditd, or kill -9 auditd"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execution of systemctl with subcommands start, stop, enable, disable"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of GUI-related binaries with suppressed window/display flags"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "curl -X POST, wget --post-data"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "command line arguments containing lsblk, fdisk, parted"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "curl -d, wget --post-data"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "grep/cat/awk on files with password fields"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "git push, curl -X POST"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of gsettings set org.gnome.login-screen disable-user-list true"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execution of setfattr or getfattr commands"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Process execution of update-ca-certificates or openssl with suspicious arguments"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "Execution of chattr to set +i or +a attributes"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "curl or wget with POST/PUT options"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "curl -T, rclone copy"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve of curl,wget,bash,sh,python with piped or remote content"
                },
                {
                    "name": "auditd:EXECVE",
                    "channel": "execve, kill, ptrace, insmod, rmmod targeting security processes"
                },
                {
                    "name": "auditd:PROCTITLE",
                    "channel": "proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters"
                },
                {
                    "name": "auditd:PROCTITLE",
                    "channel": "proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)"
                },
                {
                    "name": "auditd:PROCTITLE",
                    "channel": "process title records containing discovery command sequences and environmental assessment patterns"
                },
                {
                    "name": "auditd:PROCTITLE",
                    "channel": "command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of realmd, samba-tool, or ldapmodify with user-related arguments"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of script interpreters by systemd timer (ExecStart)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Commands like systemctl stop <service>, service <service> stop, or kill -9 <pid>"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls to locale, timedatectl, or cat /etc/timezone"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "sleep function usage or loops (nanosleep, usleep) in scripts"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "connect, execve, write"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve call including 'nohup' or trailing '&'"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "None"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Commands executed within an SSH session where no matching logon/authentication event exists"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chmod, execve"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: iptables, nft, firewall-cmd modifications"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Invocation of scp, rsync, curl, or sftp"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls modifying local mail filter configuration files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: process_name IN (\"virsh\", \"VBoxManage\", \"qemu-img\") AND command IN (\"list\", \"info\")"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: service stop syslog, systemctl stop rsyslog, kill -9 syslog"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: openssl pkcs12, certutil, keytool"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Process in container namespace executes curl|wget|bash|sh|python|nc with outbound args"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of systemctl or service with enable/start parameters"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of python, perl, or custom binaries invoking compression libraries"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve, USER_CMD"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "bash/zsh of base64, tar, gzip, or openssl immediately after file write"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Processes executing sendmail/postfix with forged headers"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "promiscuous mode transitions (ioctl or ifconfig)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chattr, rm, shred, dd run on recovery directories or partitions"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of curl or wget writing files to /tmp/* followed by chmod or execution"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of downgraded interpreters such as python2 or forced fallback commands"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Command line arguments including SPApplicationsDataType"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of spoofing tools (e.g., hping3, nping, scapy) sending UDP packets to known amplifier ports"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of tools like cat, grep, or awk on credential files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of curl, rsync, wget with internal knowledge base or IPs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of systemctl, loginctl, or systemd-inhibit commands related to sleep/hibernate"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of xev, xdotool, or input activity emulators"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of interpreters creating archive-like outputs without calling tar/gzip"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of curl, wget, or custom scripts accessing financial endpoints"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of tar, gzip, bzip2, or openssl with output redirection"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve=/sbin/shutdown or /sbin/reboot"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls modifying HISTFILE or HISTCONTROL via unset/export"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve calls to /usr/bin/locale or shell execution of $LANG"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of systemctl or service with enable/start/modify"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve: Execution of lsmod, modinfo, or cat /proc/modules"
                },
                {
                    "name": "auditd:USER_CMD",
                    "channel": "USER_CMD"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "InvokeFunction"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "SSM RunCommand"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "GetLogEvents: High frequency log exports from CloudWatch or equivalent services"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "command-line execution invoking credential enumeration"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ssm:GetCommandInvocation"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances"
                },
                {
                    "name": "azure:activity",
                    "channel": "Intune PowerShell Scripts"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain"
                },
                {
                    "name": "Command",
                    "channel": "None"
                },
                {
                    "name": "docker:api",
                    "channel": "docker logs access or container inspect commands from non-administrative users"
                },
                {
                    "name": "docker:daemon",
                    "channel": "docker exec or docker run with unexpected command/entrypoint"
                },
                {
                    "name": "docker:events",
                    "channel": "container exec rm|container stop --force"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "useradd or /etc/passwd modified inside container"
                },
                {
                    "name": "EDR:AMSI",
                    "channel": "None"
                },
                {
                    "name": "EDR:cli",
                    "channel": "Command Line Telemetry"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "command execution"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "/var/log/hostd.log"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "modification of config files or shell command execution"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "shell access or job registration"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "logline inspection"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "esxcli network firewall set commands"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "event stream"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "scp/ssh used to move file across hosts"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "None"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "esxcli system syslog config set or reload"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "command log"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Command Execution"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "remote CLI + vim-cmd logging"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "execution + payload hints"
                },
                {
                    "name": "esxi:shell",
                    "channel": "esxcli system syslog config set/reload, services.sh restart/stop"
                },
                {
                    "name": "esxi:shell",
                    "channel": "snapshot create/copy, esxcli"
                },
                {
                    "name": "esxi:shell",
                    "channel": "interactive shell"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/var/log/shell.log"
                },
                {
                    "name": "esxi:shell",
                    "channel": "invoked remote scripts (esxcli)"
                },
                {
                    "name": "esxi:shell",
                    "channel": "base64 or gzip use within shell session"
                },
                {
                    "name": "esxi:shell",
                    "channel": "scripts or binaries with misleading names"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/var/log/shell.log entries containing \"esxcli system clock get\""
                },
                {
                    "name": "esxi:shell",
                    "channel": "None"
                },
                {
                    "name": "esxi:shell",
                    "channel": "command IN (\"esxcli vm process list\", \"vim-cmd vmsvc/getallvms\")"
                },
                {
                    "name": "esxi:shell",
                    "channel": "openssl|tar|dd"
                },
                {
                    "name": "esxi:shell",
                    "channel": "Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log"
                },
                {
                    "name": "esxi:shell",
                    "channel": "CLI usage logs"
                },
                {
                    "name": "esxi:shell",
                    "channel": "Command execution trace"
                },
                {
                    "name": "esxi:shell",
                    "channel": "shell command execution for chmod, chown, or file permission modification on VMFS or system files"
                },
                {
                    "name": "esxi:shell",
                    "channel": "esxcli system syslog config set --loghost='' or stopping hostd service"
                },
                {
                    "name": "esxi:shell",
                    "channel": "Shell Access/Command Execution"
                },
                {
                    "name": "esxi:shell",
                    "channel": "esxcli software vib list"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/root/.ash_history"
                },
                {
                    "name": "esxi:shell",
                    "channel": "mv, rename, or chmod commands moving VM files into hidden directories"
                },
                {
                    "name": "esxi:shell",
                    "channel": "`esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log`"
                },
                {
                    "name": "esxi:shell",
                    "channel": "CLI session activity"
                },
                {
                    "name": "esxi:shell",
                    "channel": "esxcli system shutdown or reboot invoked"
                },
                {
                    "name": "esxi:shell",
                    "channel": "shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration"
                },
                {
                    "name": "esxi:shell",
                    "channel": "unset HISTFILE or HISTFILESIZE modifications"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "boot logs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "/var/log/vmkernel.log"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "DCUI shell start, BusyBox activity"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "esxcli system account add"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Unexpected restarts of management agents or shell access"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "esxcli, vim-cmd invocation"
                },
                {
                    "name": "esxi:vobd",
                    "channel": "shell session start"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "vCenter Management"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file system activity monitor"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "access to BPF devices or interface IOCTLs"
                },
                {
                    "name": "gcp:audit",
                    "channel": "None"
                },
                {
                    "name": "gcp:audit",
                    "channel": "methodName: setIamPolicy, startInstance, createServiceAccount"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly)"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "process execution involving curl, grep, or awk on secrets"
                },
                {
                    "name": "linux:cli",
                    "channel": "command logging"
                },
                {
                    "name": "linux:cli",
                    "channel": "Shell history logs"
                },
                {
                    "name": "linux:cli",
                    "channel": "Terminal Command History"
                },
                {
                    "name": "linux:cli",
                    "channel": "/home/*/.bash_history"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Command-line includes base64 -d or openssl enc -d"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process_events.command_line"
                },
                {
                    "name": "linux:shell",
                    "channel": "Manual invocation of software enumeration commands via interactive shell"
                },
                {
                    "name": "linux:syslog",
                    "channel": "None"
                },
                {
                    "name": "linux:syslog",
                    "channel": "cron activity"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Suspicious script or command execution targeting browser folders"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Unusual outbound transfers from CLI tools like base64, gzip, or netcat"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sudo chage|grep pam_pwquality|cat /etc/login.defs"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sshd logs"
                },
                {
                    "name": "linux:syslog",
                    "channel": "CLI access to 'show running-config', 'show password', or 'cat config.txt'"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Sudo or root escalation followed by filesystem mount commands"
                },
                {
                    "name": "linuxsyslog",
                    "channel": "nslcd or winbind logs"
                },
                {
                    "name": "m365:defender",
                    "channel": "Activity Log: Command Invocation"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Cmdlet: Get-GlobalAddressList, Get-Recipient"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Get-RoleGroup, Get-DistributionGroup"
                },
                {
                    "name": "m365:messagetrace",
                    "channel": "Inbound email triggers execution of mailbox-stored custom form"
                },
                {
                    "name": "m365:messagetrace",
                    "channel": "Inbound email matches crafted rule trigger pattern tied to persistence logic"
                },
                {
                    "name": "m365:messagetrace",
                    "channel": "Inbound email triggering Outlook to auto-access folder tied to malicious Home Page"
                },
                {
                    "name": "m365:office",
                    "channel": "Startup execution includes non-default component"
                },
                {
                    "name": "m365:office",
                    "channel": "Execution of unsigned macro from template"
                },
                {
                    "name": "m365:unified",
                    "channel": "Automated forwarding or file sync initiated by a logic app"
                },
                {
                    "name": "m365:unified",
                    "channel": "Search-Mailbox, Get-MessageTrace, eDiscovery requests"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-Mailbox, New-InboxRule"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-Mailbox, Set-MailboxPolicy, Set-TrustedLocation"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Interpreter exec with suspicious arguments as above"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd + process_events"
                },
                {
                    "name": "macos:syslog",
                    "channel": "system.log"
                },
                {
                    "name": "macos:syslog",
                    "channel": "/var/log/system.log"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dsconfigad or dscl with create or append options for AD-bound users"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl unload, kill, or pkill commands affecting daemons or background services"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of security-agent detection or enumeration commands"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of chflags hidden or SetFile -a V"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "defaults read -g AppleLocale, systemsetup -gettimezone"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "profiles install -type=configuration"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'eventMessage contains \"loginwindow\" or \"pfctl\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec or sudo usage with NOPASSWD context or echo modifying sudoers"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of /usr/bin/security add-trusted-cert or keychain modifications to System.keychain"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "nohup, disown, or osascript execution patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of 'profiles install -type=configuration'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem:com.apple.Terminal"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "base64 or curl processes chained within short execution window"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "command includes dscl . delete or sysadminctl --deleteUser"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "DS daemon log entries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "diskutil eraseDisk / asr restore with destructive flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "pwpolicy|PasswordPolicy"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Command line contains smbutil view //, mount_smbfs //"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log messages related to disk enumeration context or Terminal session"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "defaults write com.apple.system.logging or logd manipulation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process calling security find-certificate, export, or import"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of log show, fs_usage, or cat targeting system.log"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of launchctl load/unload/start commands"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "base64 -d or osascript invoked on staged file"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "diskutil partitionDisk or eraseVolume with partition scheme modifications"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "grep/cat on files matching credential patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "diskutil eraseDisk/zeroDisk or asr restore with destructive flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "spctl --master-disable, csrutil disable, or defaults write to disable Gatekeeper"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: at, job runner"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of dscl . create with IsHidden=1"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'processImagePath contains \"zip\" OR \"base64\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "xattr utility execution with -w or -p flags"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "execution of 'security', 'cat', or 'grep' commands accessing credential storage"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl load or boot-time plist registration"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dscl -create"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "kextload execution from Terminal or suspicious paths"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "xattr -d com.apple.quarantine or similar removal commands"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Security framework operations including keychain access, cryptographic operations, and certificate validation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of chflags hidden or setfile -a V"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process:spawn, process:exec"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "csrutil disable"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log show --predicate 'process == <utility>'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "command execution triggered by emond (e.g., shell, curl, python)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Set or unset HIST* variables in shell environment"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "defaults read -g AppleLocale or systemsetup -gettimezone"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl load/unload or plist file modification"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dscl . -create"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of commands like `ls -l@`, `xattr -l`, or custom tools interacting with resource forks"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of osascript, sh, bash, zsh, installer, open"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application spawns shell, command interpreter, or command-executing child process with arguments during command-execution phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application spawns Unix shell process or superuser binary such as sh, su, toybox, toolbox, or shell-like child process with parameters during execution phase"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "CLI command"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Policy Update"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "ip ssh pubkey-chain"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "erase flash:, erase startup-config, format disk"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "CLI command logs"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "cmd: cmd=show clock detail"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "None"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of commands like 'show running-config', 'copy running-config', or 'export config'"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "format flash:, format disk, reformat commands"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "erase flash:, erase nvram:, format disk"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "command logs"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "command logging"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Interface commands"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of privileged commands such as 'copy tftp flash', 'boot system', or 'debug memory'"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of commands disabling crypto hardware acceleration (e.g., 'no crypto engine enable')"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "shell command"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Commands like 'no logging' or equivalents that disable session history"
                },
                {
                    "name": "networkdevice:cli",
                    "channel": "Execution of commands such as 'copy tftp flash', 'boot system <image>', 'reload'"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "PKI export or certificate manipulation commands"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers"
                },
                {
                    "name": "networkdevice:Firewall",
                    "channel": "Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "CLI command audit / configuration command history"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Command Audit / Configuration Change"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "eventlog"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "command_exec"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "command-exec: CLI commands containing \"show clock\", \"show clock detail\", \"show timezone\" executed by suspicious user/source"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "cmd='show aaa*' OR 'show running-config | include password|aaa' OR 'show aaa common-criteria policy all'"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "CLI command audit"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "system boot logs"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "exec command='monitor capture'"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "no logging buffered, no aaa new-model, disable firewall"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "interactive shell logging"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "command sequence: erase → format → reload"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "CLI Command Logging"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "CLI Command Audit"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "command audit"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Privilege-level command execution"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Detected CLI command to export key material"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "reload command issued"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "syslog facility LOCAL7 or trap messages"
                },
                {
                    "name": "saas:PRMetadata",
                    "channel": "Commit message or branch name contains encoded strings or payload indicators"
                },
                {
                    "name": "vpxd.log",
                    "channel": "VM inventory queries and configuration enumeration through vCenter API calls"
                },
                {
                    "name": "WinEventLog:Microsoft-Office-Alerts",
                    "channel": "Unexpected DLL or component loaded at Office startup"
                },
                {
                    "name": "WinEventLog:Microsoft-Office-Alerts",
                    "channel": "Office application warning or alert on macro execution from template"
                },
                {
                    "name": "WinEventLog:Microsoft-Office/OutlookAddinMonitor",
                    "channel": "Outlook loading add-in via unexpected load path or non-default profile context"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=4103/4104/4105/4106; command/script-block content "
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Get-ADTrust|GetAllTrustRelationships"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=4103, 4104, 4105, 4106"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Execution of Microsoft script to enumerate custom forms in Outlook mailbox"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "CommandLine=copy-item or robocopy from UNC path"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "PowerShell launched from outlook.exe or triggered without user invocation"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Execution of PowerShell script to enumerate or remove malicious Home Page folder config"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Exchange Cmdlets"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "CmdletName: Get-Recipient, Get-User"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Execution of PowerShell without -NoProfile flag"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=4101"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4103, 4104, 4105, 4106"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Unix shell process (sh, bash, busybox sh, toybox) spawns as child of app process with command-line arguments indicating scripted operation — shell with arguments confirms script execution not interactive terminal"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Shell or command-executing child process with arguments spawned under managed app context on supervised iOS device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: pm uninstall OR rm -f called by process NOT IN $MDMAgentPackageList$ for package_count > $BulkUninstallThreshold$ within $DestructionWindow$ — command-line destruction activity"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App spawns sh, bash, toybox, toolbox, or su child process with command arguments within $ShellActivityWindow$ of shell launch — child shell process with arguments is the script execution signal"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Shell process (sh, bash) or command-executing child process spawned under app context on supervised iOS device — any shell spawn on stock iOS indicates jailbreak or kernel exploit"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of screenshot utility (scrot, import, xwd) on Industrial Control Systems (ICS) Human-Machine Interface (HMI) by User Identifier (UID) not in approved operator UIDs"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session"
                },
                {
                    "name": "gpo:deployment",
                    "channel": "destructive payload deployed via Group Policy Object (GPO) to multiple hosts simultaneously"
                },
                {
                    "name": "historian:applog",
                    "channel": "bulk export query returning above bulk query threshold records from account not in approved historian clients"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0041",
                    "external_id": "DC0041"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:56.009Z",
            "name": "Service Metadata",
            "description": "Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Service",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=4"
                },
                {
                    "name": "linux:syslog",
                    "channel": "service stopped messages"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launchctl disable or bootout calls"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Stop VM or disable service events via vim-cmd"
                },
                {
                    "name": "linux:syslog",
                    "channel": "auditd service stopped or disabled"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd"
                },
                {
                    "name": "linux:osquery",
                    "channel": "scheduled/real-time"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.launchservices"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "registers services with legitimate-sounding names"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7035"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Service restart with modified executable path"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Observed loading of new LaunchAgent or LaunchDaemon plist"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "seccomp or AppArmor profile changes"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Service stopped or RecoveryDisabled set via REAgentC"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Service events"
                },
                {
                    "name": "WinEventLog:WinRM",
                    "channel": "EventCode=6"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "delete: Modification of systemd unit files or config for security agents"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of system configuration profiles affecting security tools"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "kubectl delete or patch of security pods/admission controllers"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "write: Startup configuration changes disabling security checks"
                },
                {
                    "name": "auditd:DAEMON",
                    "channel": "auditd stopped, config changed, logging suspended"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--7b375092-3a61-448d-900a-77c9a4bde4dc",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0005",
                    "external_id": "DC0005"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-11-12T22:03:39.105Z",
            "name": "Scheduled Job Metadata",
            "description": "Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Scheduled Job",
                    "channel": "None"
                },
                {
                    "name": "linux:cron",
                    "channel": "cron activity"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "/Library/LaunchDaemons/*.plist, ~/Library/LaunchAgents/*.plist"
                },
                {
                    "name": "WinEventLog:TaskScheduler",
                    "channel": "Task registration/execution shortly after a time discovery event"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "New/modified launchd plist (persistence/scheduling) within TimeWindow after time query"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "/var/log/vpxa.log task invocations tied to time configuration"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=106, 200"
                },
                {
                    "name": "macos:launchd",
                    "channel": "launchd.plist and logs"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0061",
                    "external_id": "DC0061"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:40.092Z",
            "name": "File Modification",
            "description": "Changes made to a file, including updates to its contents, metadata, access permissions, or attributes. These modifications may indicate legitimate activity (e.g., software updates) or unauthorized changes (e.g., tampering, ransomware, or adversarial modifications). Examples: \n\n- Content Modifications: Changes to the content of a configuration file, such as modifying `/etc/ssh/sshd_config` on Linux or `C:\\Windows\\System32\\drivers\\etc\\hosts` on Windows.\n- Permission Changes: Altering file permissions to allow broader access, such as changing a file from `644` to `777` on Linux or modifying NTFS permissions on Windows.\n- Attribute Modifications: Changing a file's attributes to hidden, read-only, or system on Windows.\n- Timestamp Manipulation: Adjusting a file's creation or modification timestamp using tools like `touch` in Linux or timestomping tools on Windows.\n- Software or System File Changes: Modifying system files such as `boot.ini`, kernel modules, or application binaries.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "android:logcat",
                    "channel": "INSERT or UPDATE of image/*, audio/*, video/* via ContentResolver with same URI re-written within short window; abnormal MIME/container change"
                },
                {
                    "name": "AndroidLogs:FileSystem",
                    "channel": "Modification to /system/etc/init/ or /vendor/etc/init/ boot-time scripts"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf"
                },
                {
                    "name": "auditd:FILE",
                    "channel": "Modification of Display Manager configuration files (/etc/gdm3/*, /etc/lightdm/*)"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "/etc/passwd or /etc/group file write"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "write: Modification of /boot/grub/*, /boot/efi/EFI/*, or initramfs images"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "write or create events on *.pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "write: File modifications to /etc/systemd/sleep.conf or related power configuration files"
                },
                {
                    "name": "auditd:PATH",
                    "channel": "odification of ~/.ssh/authorized_keys or credential files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write calls modifying ~/.bashrc, ~/.profile, or /etc/paths.d"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "AUDIT_SYSCALL (open, write, rename, unlink)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "PATH"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve call for modification of /etc/sudoers or writing to /var/db/sudo"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write: File modifications under /etc/ssl/certs, /usr/local/share/ca-certificates, or /etc/pki/ca-trust/source/anchors"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write of .service unit files"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write/unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write, rename"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write | PATH=/home/*/.ssh/authorized_keys"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write: Write operations targeting /dev/sda, /dev/nvme0n1, or EFI partition mounts"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write to /etc/pam.d/*"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write: Modification of structured stored data by suspicious processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "openat, write, rename, unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "modification of existing .service file"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write: Modification of /boot/grub/* or /boot/efi/*"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chmod"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "rename,chmod"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Modification of user shell profile or trap registration via echo/redirection (e.g., echo \"trap 'malicious_cmd' INT\" >> ~/.bashrc)"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chmod, write, create, open"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open, write: File writes to application binaries or libraries at runtime"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "file write operations in /Library/WebServer/Documents"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write operation on /etc/passwd or /etc/shadow"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "mount or losetup commands creating hidden or encrypted FS"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write to /proc/*/mem or /proc/*/maps"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write or rename to /etc/systemd/system or /etc/init.d"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "modification of entrypoint scripts or init containers"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "chmod/chown to /etc/passwd or /etc/shadow"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "open/write syscalls targeting web directory files"
                },
                {
                    "name": "azure:resource",
                    "channel": "PATCH vm/authorized_keys"
                },
                {
                    "name": "containerd:runtime",
                    "channel": "file change monitoring within /etc/cron.*, /tmp, or mounted volumes"
                },
                {
                    "name": "ebpf:syscalls",
                    "channel": "file_write"
                },
                {
                    "name": "esxi:cron",
                    "channel": "manual edits to /etc/rc.local.d/local.sh or cron.d"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "boot"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "modification of crontab or local.sh entries"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "binary or module replacement event"
                },
                {
                    "name": "esxi:shell",
                    "channel": "file write or edit"
                },
                {
                    "name": "esxi:shell",
                    "channel": "admin command usage"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "rename .vmdk to .*.locked|datastore write spike"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Unauthorized file modifications within datastore volumes via shell access or vCLI"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "/var/log/vmkernel.log"
                },
                {
                    "name": "ESXiLogs:messages",
                    "channel": "changes to /etc/motd or /etc/vmware/welcome"
                },
                {
                    "name": "File",
                    "channel": "None"
                },
                {
                    "name": "FileIntegrity:ImageValidation",
                    "channel": "Hash/checksum mismatch against baseline vendor-provided OS image versions"
                },
                {
                    "name": "firmware:update",
                    "channel": "Unexpected or unscheduled firmware updates, image overwrites, or failed signature validation"
                },
                {
                    "name": "FirmwareLogs:Update",
                    "channel": "Unexpected firmware or image updates modifying cryptographic modules"
                },
                {
                    "name": "FirmwareLogs:Update",
                    "channel": "Unexpected firmware updates that alter encryption libraries or disable hardware crypto modules"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "/var/log/quarantine.log"
                },
                {
                    "name": "fs:fileevents",
                    "channel": "/var/log/install.log"
                },
                {
                    "name": "fs:filesystem",
                    "channel": "Modification or creation of files matching 'com.apple.loginwindow.*.plist' in ~/Library/Preferences/ByHost"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "create/write/rename under user-writable paths"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "file system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags"
                },
                {
                    "name": "fs:fsevents",
                    "channel": "Extensions"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "unlink, write"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file access to /usr/lib/cron/tabs/ and cron output files"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file access to /usr/lib/cron/at and job execution path"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "modification of existing LaunchAgents plist"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "Filesystem Access Logging"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "truncate, unlink, write"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "file write to launchd plist paths"
                },
                {
                    "name": "fs:launchdaemons",
                    "channel": "file_modify"
                },
                {
                    "name": "fs:plist",
                    "channel": "/var/root/Library/Preferences/com.apple.loginwindow.plist"
                },
                {
                    "name": "fs:plist_monitoring",
                    "channel": "/Users/*/Library/Mail/V*/MailData/RulesActiveState.plist"
                },
                {
                    "name": "gcp:audit",
                    "channel": "compute.instances.setMetadata"
                },
                {
                    "name": "IntegrityCheck:ImageValidation",
                    "channel": "Checksum or hash mismatch between running image and known-good vendor-provided image"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Creation or modification of LaunchDaemon or LaunchAgent plist in /System/Library/LaunchDaemons, /Library/LaunchDaemons, or /Library/LaunchAgents"
                },
                {
                    "name": "linux:fim",
                    "channel": "Changes to /etc/rc.local.d/local.sh or creation of unexpected startup files in persistent partitions (/etc/init.d, /store, /locker)"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "linux:osquery",
                    "channel": "New or modified kernel object files (.ko) within /lib/modules directory"
                },
                {
                    "name": "linux:syslog",
                    "channel": "rename"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Unexpected log entries or malformed SQL operations in databases"
                },
                {
                    "name": "m365:defender",
                    "channel": "OfficeTelemetry or DLP"
                },
                {
                    "name": "m365:office",
                    "channel": "Anomalous editing of invoice or payment document templates"
                },
                {
                    "name": "macos:auth",
                    "channel": "~/.ssh/authorized_keys"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "write, rename"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "query: Enumeration of root certificates showing unexpected additions"
                },
                {
                    "name": "macos:osquery",
                    "channel": "File modifications in ~/Library/Preferences/"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Changes to LSFileQuarantineEnabled field in Info.plist"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CALCULATE: Mismatch in file integrity of critical macOS applications"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table"
                },
                {
                    "name": "macos:osquery",
                    "channel": "write"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File modification in /etc/paths.d or user shell rc files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Anomalous plist modifications or sensitive file overwrites by non-standard processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow or desktopservices modified settings or files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "SecurityAgentPlugins modification"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of backgrounditems.btm or creation of LoginItems subdirectory in .app bundle"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of plist with apple.awt.UIElement set to TRUE"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "replace existing dylibs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of /Library/Security/SecurityAgentPlugins"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modifications to Mail.app plist files controlling message rules"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Unexpected creation or modification of stored data files in protected directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file encrypted|new file with .encrypted extension|disk write burst"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Mach-O binary modified or LC_LOAD_DYLIB segment inserted"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modified application plist or binary replacement in /Applications"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File creation or overwrite in common web-hosting folders"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "write"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of /System/Library/CoreServices/boot.efi"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of LaunchAgents or LaunchDaemons plist files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Plist modifications containing virtualization run configurations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "binary modified or replaced"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification of /Library/Preferences/com.apple.loginwindow plist"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "File write or append to .zshrc, .bash_profile, .zprofile, etc."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "write: File modification to com.apple.PowerManagement.plist or related system preference files"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "create/modify dylib in monitored directories"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "modification to /var/db/dslocal/nodes/Default/users/"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Hidden volume attachment or modification events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Suspicious plist edits for volume mounting behavior"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "file writes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "rule definitions written to emond rule plists"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Terminal/Editor processes modifying web folder"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application inserts, updates, deletes, hides, or marks message records in SMS store or messaging database immediately after SMS receive or send event"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application inserts, updates, deletes, or rewrites call-log records immediately after call-control action to conceal, alter, or synthesize call history"
                },
                {
                    "name": "network:runtime",
                    "channel": "checksum or runtime memory verification failures"
                },
                {
                    "name": "networkconfig",
                    "channel": "unexpected OS image file upload or modification events"
                },
                {
                    "name": "networkdevice:audit",
                    "channel": "SNMP configuration changes, such as enabling read/write access or modifying community strings"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "config-change: timezone or ntp server configuration change after a time query command"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes to boot variables, startup image paths, or checksum verification failures"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes referencing 'crypto', 'key length', 'cipher', or downgrade of encryption settings"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration file modified or replaced on network device"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration change events referencing encryption, TLS/SSL, or IPSec settings"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes to startup image paths, boot loader parameters, or debug flags"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes referencing cryptographic hardware modules or disabling hardware acceleration"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Configuration changes referencing older image versions or unexpected boot parameters"
                },
                {
                    "name": "networkdevice:firmware",
                    "channel": "Unexpected firmware update or image modification affecting crypto modules"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "config"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "startup-config"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Checksum/hash mismatch between device OS image and baseline known-good version"
                },
                {
                    "name": "sysdig:file",
                    "channel": "evt.type=write"
                },
                {
                    "name": "WinEventLog:CodeIntegrity",
                    "channel": "EventCode=3033"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=2"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Unexpected modification to lsass.exe or cryptdll.dll"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to /sdcard/ path"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: ContentResolver.update() or write() to path owned by target_app IN $HighValueAppList$ by writer_app != target_app — cross-app data modification"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: write() to path IN $SystemBinaryPaths$ by process NOT IN $TrustedUpdateSources$"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change detected in MDM inventory for app_package — update is the binary modification event"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: app version change in MDM inventory for bundle_id"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to /etc/ld.so.preload by User Identifier (UID) outside authorized admin list"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to alarm threshold config file by uid not in authorized alarm admin User Identifiers (UIDs)"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Siemens engineering tool opens project file from path not in approved project repository"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d",
            "created": "2022-09-23T16:36:08.632Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0111",
                    "external_id": "DC0111"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:43.366Z",
            "name": "Software",
            "description": "This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Asset",
                    "channel": "None"
                },
                {
                    "name": "assetinventory:ProgramDiff",
                    "channel": "current task-to-block assignment table differs from last known-good baseline without corresponding change ticket"
                },
                {
                    "name": "assetinventory:ProgramHash",
                    "channel": "program hash differs from last authorized baseline without corresponding change ticket reference"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
            "created": "2022-05-11T16:22:58.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0107",
                    "external_id": "DC0107"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:50.698Z",
            "name": "Process History/Live Data",
            "description": "This includes any data stores that maintain historical or real-time events and telemetry recorded from various sensors or devices",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Databases",
                    "channel": "None"
                },
                {
                    "name": "Operational Databases",
                    "channel": "None"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "multiple safety-critical outputs toggle within rapid toggle window, pattern consistent with scripted issuance"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "reported values show statistically improbable stability during a period when physical process is known to be actively changing"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "process value expected to change following a command does not change within command confirmation window"
                },
                {
                    "name": "operationaldb:ProcessHistory",
                    "channel": "no unsolicited report received from device_ip within 1.5x expected reporting interval, while direct polling confirms device is reachable"
                },
                {
                    "name": "processsensor:RedundantComparison",
                    "channel": "Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0021",
                    "external_id": "DC0021"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:47.873Z",
            "name": "OS API Execution",
            "description": "Calls made by a process to operating system-provided Application Programming Interfaces (APIs). These calls are essential for interacting with system resources such as memory, files, and hardware, or for performing system-level tasks. Monitoring these calls can provide insight into a process's intent, especially if the process is malicious.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "UIDevice.current.model AND CMMotionManager.isDeviceMotionAvailable AND UIScreen.main.scale all read within $EnvCheckWindow$ at cold launch by app NOT IN $SystemEnumAllowList$"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "System.getProperty() AND SensorManager.getSensorList() AND getNetworkInterfaces() all called > $EnvCheckThreshold$ calls within $EnvCheckWindow$ by app NOT IN $SystemEnumAllowList$ where app_state=background"
                },
                {
                    "name": "android:logcat",
                    "channel": "SELinux AVC for execmem/execute_no_trans/mprotect following recent writes by same UID"
                },
                {
                    "name": "android:logcat",
                    "channel": "QUERY on exported ContentProviders of other packages (content://<other.pkg>/*) or MediaStore scoped queries immediately preceding file reads"
                },
                {
                    "name": "android:logcat",
                    "channel": "ClipboardManager (addOnPrimaryClipChangedListener|getPrimaryClip|getPrimaryClipDescription) invoked by <pkg>"
                },
                {
                    "name": "android:logcat",
                    "channel": "AccessibilityService connected|TYPE_VIEW_TEXT_CHANGED|TYPE_VIEW_FOCUSED events for other packages"
                },
                {
                    "name": "android:logcat",
                    "channel": "TYPE_WINDOW_STATE_CHANGED / TYPE_VIEW_FOCUSED shows foreign target package in foreground"
                },
                {
                    "name": "android:logcat",
                    "channel": "PackageManager getInstalledApplications|getInstalledPackages|getPackagesHoldingPermissions burst for <pkg>. TYPE_WINDOW_STATE_CHANGED shows foreground app then immediate package queries by <pkg>"
                },
                {
                    "name": "android:logcat",
                    "channel": "getInstalledPackages/getPackagesHoldingPermissions with filters for known security/MDM/VPN package names. Queries to isDeviceOwnerApp/isProfileOwnerApp/getActiveAdmins/getPermissionGrantState. Requests list of enabled services or monitors TYPE_WINDOW_STATE_CHANGED to time checks"
                },
                {
                    "name": "android:logcat",
                    "channel": "ACTION_VIEW redirect_uri handled by unexpected package"
                },
                {
                    "name": "android:logcat",
                    "channel": "canOpenURL/LSApplicationWorkspace resolved to unexpected bundle for redirect_uri"
                },
                {
                    "name": "android:logcat",
                    "channel": "query() against MediaStore/DocumentsContract URIs (Images/Video/Audio/Downloads/DocumentTree)"
                },
                {
                    "name": "android:logcat",
                    "channel": "wifiservice startScan / scanResults retrieved repeatedly or by unexpected package"
                },
                {
                    "name": "android:logcat",
                    "channel": "bluetoothmanager startDiscovery / getBondedDevices / scan callback bursts by package"
                },
                {
                    "name": "android:logcat",
                    "channel": "telephony cell info enumeration bursts (neighboring/all cell info) by package"
                },
                {
                    "name": "android:logcat",
                    "channel": "repeated queries or dumps related to running tasks/services/process state by same package/UID (e.g., getRunningAppProcesses, running services/task inspection)"
                },
                {
                    "name": "android:logcat",
                    "channel": "Application accesses android.os.Build fields or device configuration APIs (MODEL, MANUFACTURER, VERSION.SDK_INT, HARDWARE)"
                },
                {
                    "name": "android:logcat",
                    "channel": "Invocation of MediaRecorder.start(), AudioRecord.startRecording(), or VOICE_CALL audio source"
                },
                {
                    "name": "android:logcat",
                    "channel": "Application invokes LocationManager, FusedLocationProviderClient, or GPS/location sensor APIs"
                },
                {
                    "name": "android:logcat",
                    "channel": "Invocation of Calendar.set() and Calendar.add()"
                },
                {
                    "name": "android:logcat",
                    "channel": "Invocation of CallLogs.getLastOutgoingCall()"
                },
                {
                    "name": "android:logcat",
                    "channel": "Invocation of ContactsContract.Contacts.getLookupUri() and/or ContactsContract.Contacts.lookupContact()"
                },
                {
                    "name": "android:logcat",
                    "channel": "Invocation of AccountManager.getAccounts()"
                },
                {
                    "name": "AndroidLogs:Kernel",
                    "channel": "Unprivileged app process (app UID, non-system) invoking sensitive syscalls or device interfaces associated with privilege escalation (setuid, ptrace, perf_event_open, vulnerable drivers)"
                },
                {
                    "name": "auditd:MMAP",
                    "channel": "memory region with RWX permissions allocated"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ptrace, ioctl"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Rules capturing clock_gettime, time, gettimeofday syscalls when enabled"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "mmap, ptrace, process_vm_writev or direct memory ops"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unshare, mount, keyctl, setns syscalls executed by containerized processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "send, recv, write: Abnormal interception or alteration of transmitted data"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "sudo or pkexec invocation"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "mount system call with bind or remap flags"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "fork/clone/daemon syscall tracing"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ptrace, mmap, mprotect, open, dlopen"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ptrace, mmap, process_vm_writev"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve of dd or sed targeting /proc/*/mem"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "GetMetadata, DescribeInstanceIdentity"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "Describe* or List* API calls"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "Decrypt"
                },
                {
                    "name": "EDR:file",
                    "channel": "SetFileTime"
                },
                {
                    "name": "EDR:memory",
                    "channel": "Behavioral API telemetry (GetProcAddress, LoadLibrary, VirtualAlloc)"
                },
                {
                    "name": "EDR:memory",
                    "channel": "API usage MFCreateDeviceSource, IAMStreamConfig, ICaptureGraphBuilder2, DirectShow filter graph creation from uncommon callers"
                },
                {
                    "name": "EDR:memory",
                    "channel": "Objective‑C/Swift calls to AVCaptureDevice/AVCaptureSession by non-whitelisted processes"
                },
                {
                    "name": "EDR:memory",
                    "channel": "VirtualAlloc/VirtualProtect/MapViewOfFile indicators via stack/heap activity and ImageLoad"
                },
                {
                    "name": "EDR:memory",
                    "channel": "MemoryWriteToExecutable"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Remote access API calls and file uploads"
                },
                {
                    "name": "ETW",
                    "channel": "Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList"
                },
                {
                    "name": "etw:Microsoft-Windows-Directory-Services-SAM",
                    "channel": "api_call: Calls to DsAddSidHistory or related RPC operations"
                },
                {
                    "name": "etw:Microsoft-Windows-DotNETRuntime",
                    "channel": "AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Base",
                    "channel": "GetLocaleInfoW, GetTimeZoneInformation API calls"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-File",
                    "channel": "ZwSetEaFile or ZwQueryEaFile function calls"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "API tracing / stack tracing via ETW or telemetry-based EDR"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "APCQueueOperations"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "API Calls"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "NtQueryInformationProcess"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess* with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "API calls"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses"
                },
                {
                    "name": "etw:Microsoft-Windows-RPC",
                    "channel": "rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes"
                },
                {
                    "name": "etw:Microsoft-Windows-Security-Auditing",
                    "channel": "api_call: LogonUser(A|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser"
                },
                {
                    "name": "etw:Microsoft-Windows-Win32k",
                    "channel": "SetWindowLong, SetClassLong, NtUserMessageCall, SendNotifyMessage, PostMessage"
                },
                {
                    "name": "etw:Microsoft-Windows-Win32k",
                    "channel": "SendMessage, PostMessage, LVM_*"
                },
                {
                    "name": "ETW:ProcThread",
                    "channel": "api_call: CreateProcessWithTokenW, CreateProcessAsUserW"
                },
                {
                    "name": "ETW:Token",
                    "channel": "token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser"
                },
                {
                    "name": "ETW:Token",
                    "channel": "api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "Detached process execution with no associated parent"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "kernel fault referencing ptrace OR task_for_pid OR get-task-allow outside developer-signed build + MDM integrity_check=fail within KernelFaultWindow where no developer entitlement justifies kernel-level process access"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "mmap/mprotect transitions to PROT_EXEC for pages associated with recently written files"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "LSApplicationWorkspace or canOpenURL probe bursts for many URL schemes"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Queries indicating MDM profile presence, supervised state, restrictions read. LSApplicationWorkspace enumeration or app proxy queries referencing security vendors"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "enumeratorForContainerItemIdentifier / itemForIdentifier across multiple containers/providers"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Application invokes UIDevice queries (model, systemVersion, name)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Invocation of AVAudioRecorder, AVCaptureSession, or related audio capture framework calls"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Application activates CoreLocation services or CLLocationManager APIs"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Supplemental anomaly in baseband, IOKit, accessory, security, or activation-related subsystem logging temporally adjacent to suspicious posture or network behavior"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Supplemental managed app or system subsystem anomalies near install/update, launch services, extension handling, app activation, or background execution temporally adjacent to suspicious network or lifecycle behavior"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Supplemental launch, background task, networking, or extension-handling anomalies occur temporally adjacent to suspicious web-service communication from a managed app or supervised device"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Background task or networking subsystem event occurred immediately before resolver retrieval and pivot connection sequence"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Background task, networking, or app-activation subsystem event occurred immediately before or during retrieve-then-write exchange with public web-service platform"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Camera, media capture, app-activation, or background-task subsystem event occurred immediately before or during sustained camera session from same managed-app or device context"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Execution of modified binaries or abnormal library load sequences"
                },
                {
                    "name": "macos:osquery",
                    "channel": "open, execve: Unexpected processes accessing or modifying critical files"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CALCULATE: Integrity validation of transmitted data via hash checks"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "None"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Invocation of SMLoginItemSetEnabled by non-system or recently installed application"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "flock|NSDistributedLock|FileHandle.*lockForWriting"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "application logs referencing NSTimer, sleep, or launchd delays"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Access decisions to kTCCServiceCamera for unexpected binaries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "audio APIs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "com.apple.securityd, com.apple.tccd"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "authorization execute privilege requests"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "ptrace: Processes invoking ptrace with PTRACE_TRACEME flag"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Calls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "access or unlock attempt to keychain database"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Execution of input detection APIs (e.g., CGEventSourceKeyState)"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "PackageInstaller.install() with install_initiator NOT IN ApprovedInstallSources + MDM policy_violation raised within InstallWindow where approved sources do not include this installer origin"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "ptrace with action IN (PTRACE_ATTACH, PTRACE_POKETEXT, PTRACE_POKEDATA, PTRACE_SETREGS) where caller_uid != target_uid + MDM developer_mode=false within PtraceWindow where no debug session justifies memory write to unrelated process"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "process accesses memory region or task port beyond declared entitlement set + MDM integrity_check=fail within same device session where declared entitlements do not justify observed resource access"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "ptrace(PTRACE_ATTACH) from caller_pid where caller is NOT parent of target AND NOT in DebuggerAllowList + MDM usb_debug=false within PtraceWindow where developer context does not justify cross-process attach"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "dylib loaded into process address space with path OR behavioral hash matching KnownJailbreakLibPatterns + MDM compliance=pass within same device session where compliance posture does not justify library presence"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "execve/execveat with effective UID=0 from path NOT IN KnownSystemBinPaths + MDM compliance root_status=false within same device context where compliance state does not justify elevated execution"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Framework-based networking usage spikes or uncommon networking stacks observed by agent telemetry (e.g., repeated URLSession/OkHttp-like patterns) without corresponding foreground/user interaction"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Agent-observable telephony subscription/state API signals indicating SIM/eSIM subscription change (vendor-agnostic: 'telephony subscription changed')"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Accessibility framework usage patterns such as event subscription, performAction invocation, node traversal, text change observation, or overlay/window presentation correlated to app identity"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Browser/WebView framework usage indicating external URL load, script execution enablement, file download initiation, intent handoff, or package install prompt sequence"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Observed device-service, trust-service, backup/service interaction, or other privileged framework activity associated with physical host access"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Connectivity manager, telephony, Wi-Fi, network callback, or location-provider framework reports repeated unavailable, disconnected, suspended, or degraded state transitions"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Observed network-path, reachability, DNS, transport, or location-provider framework reports repeated unavailable or failed state near active device use"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Content resolver, document provider, media store, storage access framework, bulk stream processing, or repeated crypto-adjacent framework use observed during multi-file transformation"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Known application begins first-seen or expanded use of content providers, account services, accessibility, package services, cryptographic routines, dynamic loading, or other framework interactions after update/install"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Known application begins first-seen or expanded use of protected frameworks, account services, background task APIs, crypto/network service APIs, or other runtime behaviors after update/install"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Known application begins first-seen or expanded use of account services, accessibility, content providers, dynamic loading, package services, WebView bridges, crypto/network APIs, or advertising/telemetry-adjacent framework behavior after install or update"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Privileged or OEM-context framework/API use tied to telephony, device policy, accessibility, overlay, input injection, package visibility, or protected settings modification from an identity not expected for the device model or approved image"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Recently installed or updated trusted app invokes Android framework paths or special access patterns inconsistent with its role, including accessibility-like behavior, overlay behavior, package visibility expansion, protected settings access, device policy interaction, or unusual IPC/provider access"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App uses Android framework behaviors associated with background work scheduling, network job execution, IPC/provider access, overlay or accessibility-like interaction, or unusual package visibility immediately adjacent to web-service communication"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Background work scheduler, job execution, or persistent service triggered network request to public web-service followed by second outbound connection within TimeWindow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Background work scheduler, job execution, foreground-service start, or persistent service activation immediately preceded retrieve-then-write exchange with public web-service platform"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Background work scheduler, job execution, foreground-service start, or persistent service activation immediately preceded outbound session using non-standard protocol-to-port pairing"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "MediaProjection-style screen capture session began from app identity while a different app was foregrounded and capture path was not mapped to approved recording workflow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Accessibility-service activity from app identity coincided with foreground content observation and subsequent screenshot, frame buffer, or screenrecord artifact behavior within TimeWindow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Privileged screencap, screenrecord, adb-driven capture, or root-context screen acquisition behavior occurred from app, shell, or elevated identity while foreground app context changed or sensitive app remained active"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Accessibility-enabled app invoked programmatic click or action on behalf of user while a different app was foregrounded and injected action was not mapped to approved accessibility or autofill workflow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Accessibility-enabled app invoked global action such as back, home, recents, or navigation control while target foreground app context changed within TimeWindow"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Accessibility-enabled app inserted text into active field of different foreground app without user keyboard activity or approved autofill relationship"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App intercepts notification content from external package (e.g., messaging/auth apps) while in background OR without recent user interaction"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App invokes cryptographic functions (e.g., AES/RSA/KeyStore usage) on buffer data followed by encode/transform operations not tied to normal app workflows"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App invokes symmetric encryption routines (e.g., AES/RC4 cipher initialization + encrypt operations) with repeated key usage across multiple data buffers"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Symmetric key material reused across multiple encryption operations within short interval OR derived locally without secure hardware-backed storage"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "App invokes asymmetric cryptographic operations (e.g., RSA/ECC keypair generation OR public key encryption OR signature operations) on outbound data buffers"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Keypair generation, import, or access events (public/private key usage) occurring prior to network communication"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes custom TLS trust evaluation logic or pin validation routines (e.g., custom TrustManager, HostnameVerifier override, certificate/public key comparison) immediately before outbound TLS session establishment"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes archive, compression, or bulk-buffer packaging routines on previously accessed local data within the same execution chain"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application encrypts newly created archive or staged data blob after collection and before storage or outbound transfer"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application performs bulk data transformation or packaging-like processing on collected records prior to file creation or upload"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application queries or opens multiple local SQLite or app-associated database stores containing records unrelated to the app's declared function during the collection phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application performs repeated record access, container traversal, or local data extraction processing against local stores before staging or transmission"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application calls startForegroundService() or startForeground() / ServiceCompat.startForeground() and transitions to persistent foreground-service execution at the start of the chain"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes direct file retrieval, DownloadManager usage, or streaming write from network response to local storage immediately after remote session establishment"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Managed app performs post-download unpacking, dynamic resource handling, or module preparation immediately after local payload creation"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application loads or resolves native shared library (.so) or JNI bridge immediately before suspicious native execution phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application transitions from managed code into JNI/native function execution or attaches native thread to runtime during the execution phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Existing application is replaced, updated, or reinstalled and the resulting package metadata, code sections, or executable-supporting artifacts diverge from known-good baseline during the persistence-establishment phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes SMS send, intercept, delete, or provider-write behavior, including handling SMS_DELIVER or interacting with SMS content provider during unauthorized message-control phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application enqueues WorkManager work request or schedules JobScheduler or AlarmManager task with delay, periodic interval, or execution constraints during the persistence/execution setup phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application creates or executes NSBackgroundActivityScheduler activity with repeating or deferred invocation semantics during the scheduling and trigger phases"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application initializes proxy-capable or raw-socket networking constructs, including SOCKS-capable Proxy API usage or direct socket listener/setup immediately before traffic relay phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application invokes call placement, answer, redirect, block, screening, or ConnectionService call-handling APIs during unauthorized call-control phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application process loads external code modules or injects into runtime (zygote/app_process) + abnormal library loading or method interception behavior"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "Application registers broadcast receiver, WorkManager job, JobScheduler task, or intent filter tied to system event such as BOOT_COMPLETED, SMS_RECEIVED, CONNECTIVITY_CHANGE during persistence setup phase"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application registers or invokes broadcast receiver via registerReceiver() or manifest-declared receiver + intent filter tied to system or app events"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application launches or executes code where loaded library or component path does not match application package path or expected signing context"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "multiple applications invoking core system APIs (e.g., sensor, permission, telephony) with abnormal or inconsistent return values across apps within short interval"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "device integrity degradation + root detected or system partition modification affecting runtime libraries (e.g., /system/lib*, /vendor/lib*)"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes privileged framework APIs (Accessibility events, UI automation, package install flows) immediately following permission grant"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes DevicePolicyManager APIs (e.g., resetPassword, lockNow, setCameraDisabled) immediately following admin activation"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application queries target-selection attributes (e.g., location, SIM/operator, locale, device state, network identity) and then conditionally invokes sensitive framework APIs only after expected value is observed"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application exhibits repeated environment-context evaluation followed by delayed privileged framework use only after target-specific match"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes geolocation or geofencing framework operations (e.g., location polling or geofence registration/evaluation) and sensitive framework activity begins only after region match or location threshold condition"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application exhibits repeated location-context evaluation followed by delayed privileged framework use or feature activation only after target region match"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes package or component state changes affecting launcher-facing activity availability and subsequently continues operational framework activity after icon suppression"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes motion-sensor or device-activity framework operations followed by conditional execution of sensitive framework activity only after inferred user absence"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes system framework operations that alter monitoring, accessibility, or execution visibility followed by reduction in expected telemetry generation"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes accessibility global actions (back/home/recents) or observes package-management UI immediately after uninstall/settings screen becomes foreground"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes lock-related or UI-denial framework operations, including DevicePolicyManager lock actions, persistent overlay behavior, or accessibility-driven navigation interference immediately before device enters locked or unusable state"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes package, settings, or privileged framework operations capable of disabling security software, altering security enforcement, or interfering with reporting before telemetry loss"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes uninstall-related package-management operations, accessibility-driven uninstall confirmation actions, or privileged file-removal operations immediately before installed-state loss"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application invokes file-management, package, storage, or administrative wipe operations immediately before loss of expected local files or file collections"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "aaa privilege_exec"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Unexpected reload, crashinfo, or boot message not tied to scheduled maintenance"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "smb_command: TreeConnectAndX to \\\\*\\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares"
                },
                {
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "name": "snmp:trap",
                    "channel": "management queries"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "API call to AddMonitor invoked by non-installer process"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-COM/Operational",
                    "channel": "CLSID activation events where ProcessName=mmc.exe and CLSID not in allowed baseline"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes DevicePolicyManager.lockNow(), creates persistent fullscreen overlay (TYPE_APPLICATION_OVERLAY covering full screen), or uses accessibility to block UI interaction — lock or UI-denial API invocation"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background work scheduler or persistent service triggered the platform retrieval without user interaction"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background task or networking subsystem event immediately before platform retrieval"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes DevicePolicyManager.resetPassword(), lockNow(), wipeData(), or setCameraDisabled() immediately after Device Admin activation without MDM-initiated policy context or user interaction"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes file management, storage-clear, or wipe operations in background state following network upload without user-initiated delete action"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes custom TLS trust evaluation, OkHttp CertificatePinner, or custom-anchor TrustManager NOT IN $ApprovedPinningApps$ — custom pin validation is the evasion mechanism"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: MediaProjection capture session, accessibility-based foreground content observation, or privileged screencap/screenrecord invocation from app while different app is foregrounded — cross-app screen content access"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Multiple applications invoking core system APIs (sensor, permission, telephony, PackageManager) show inconsistent, suppressed, or modified return values compared to OS-expected behavior — cross-app API result inconsistency is the runtime hi"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Device integrity degradation (root detected, system partition modification, SafetyNet/Play Integrity failure) coincident with anomalous system API behavior affecting runtime resolution"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background scheduler or persistent service triggers retrieve-then-write cycle"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background task activation immediately before retrieve-then-write cycle on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Application registers BroadcastReceiver via registerReceiver() or manifest-declared receiver for sensitive system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $ApprovedReceiverApp"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes PackageManager.setComponentEnabledSetting() to COMPONENT_ENABLED_STATE_DISABLED on its own LAUNCHER activity while continuing active background or foreground-service execution"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Unified Log entry at level=fault in subsystem com.apple.kernel or com.apple.sandbox within $KernelFaultWindow$ of integrity_check failure — kernel-level fault coincident with integrity failure is the exploit-execution signal; requires super"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: ConnectivityManager, TelephonyManager, or WifiManager framework callbacks report repeated failure, disable, or oscillation events outside expected coverage-transition pattern"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: ContentResolver, DocumentProvider, StorageAccessFramework, or bulk stream I/O invocations exceed $FileModificationRateThreshold$ operations per minute across distinct file paths — API-level operation rate distinguishes ransomware from norma"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Known application begins first-seen or expanded use of content providers, account services, accessibility, or network destinations not in $AppBehaviorBaseline$ post-update"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Known app begins first-seen use of protected framework categories (location, microphone, contacts) or background task patterns post-update"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Recently updated trusted app invokes special-access paths, account services, or accessibility not present in prior version baseline"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App uses background work scheduler, JobScheduler, or persistent service to trigger web-service resolver fetch without user interaction"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background task or networking subsystem event occurs immediately before web-service resolver fetch"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background work scheduler, foreground service, or persistent service activates"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Background task or persistent networking event activates"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Accessibility-enabled app NOT IN $AccessibilityAllowList$ invokes performAction() click, global action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on a UI element belonging to a different foregrounded app — cross-app UI action is the"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App intercepts notification content from source_app IN $HighValueNotifApps$ (banking, auth, messaging) while AppState=background"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes cryptographic functions (javax.crypto.Cipher, Android KeyStore, AES/RSA/ECC operations) on data buffer followed by encode-then-transmit sequence NOT matching app declared network function — app-layer crypto on data before transm"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes ContentResolver or SAF (Storage Access Framework) queries across multiple user-data paths outside its own sandbox in background state"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Managed app accesses broad local data scope without user-initiated document picker interaction on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes startForegroundService() or startForeground() NOT IN $ApprovedForegroundServiceApps$"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes DownloadManager, URLConnection, or OkHttp download to write retrieved content to app-controlled path outside original APK scope — programmatic download of executable artifact"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Managed app performs post-download processing, dynamic resource handling, or module preparation immediately after retrieval from non-CDN source on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App loads native library (.so) or resolves JNI bridge NOT IN $ApprovedNativeLibraries$ immediately before suspicious lower-level activity (sensor access, file write, network connection) — native code loading before anomalous activity is the"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App transitions from managed-code execution into JNI/native function context or attaches native thread,"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App is replaced or reinstalled"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App enqueues WorkManager work, schedules JobScheduler job, or sets AlarmManager with repeating interval NOT IN $ApprovedSchedulerApps$"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Managed app creates NSBackgroundActivityScheduler activity or registers BGTask with repeating=true or deferred interval outside $ApprovedSchedulerApps$ function"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App initializes proxy-capable or raw-socket networking constructs (ServerSocket, SOCKS proxy client, bidirectional relay) NOT IN $ApprovedProxyApps$ — proxy initialization is the technique enabler"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App process loads external code module or native library from non-system path injected into zygote or app_process runtime — abnormal library injection path is the hooking mechanism indicator"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes SensorManager.registerListener() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $ApprovedMotionApps$ followed by conditional execution branching correlated with sensor readings — motion sensing followed by behavioral conditiona"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App registers BroadcastReceiver or schedules job for system events (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, ACTION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ — sensitive system event registration is"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App loads library or executes component"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes privileged framework APIs (accessibility performAction, WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInstaller) immediately after acquiring elevation control mechanism without expected user settings navigation time"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App performs burst of environmental check APIs (Build properties, TelephonyManager IMSI, PackageManager security-tool query) at cold launch before user interaction — multi-category environment fingerprint is the guardrail setup"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App performs UIDevice model + iOS version + enrollment state checks at cold launch before user interaction — device fingerprinting guardrail setup"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes package management, DevicePolicyManager, or settings operations capable of disabling security tooling — API invocation to disable security control"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes accessibility global actions (back, home, recents) or DevicePolicyManager removal-resistance operations when package-management or uninstall UI is in foreground — active uninstall interference"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes package manager operations (disable component, clear data, request uninstall) or settings modifications targeting security tool packages IN $SecurityToolPackageList$"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes file deletion, database truncation, log clearing, or app-data-clear operations within $CleanupWindow$ of prior data access or network exfiltration event — post-exfil cleanup chain"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: App invokes file deletion, container-local database truncation, or cache-clear operations on supervised device within $CleanupWindow$ of prior data access or upload event"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Protected resource use, privileged API invocation, or telephony/accessibility/overlay access occurs from system-app context while device is locked or before normal setup completion"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: Supplemental baseband, IOKit, accessory, security, or activation-related subsystem anomalies on supervised device at activation — Unified Log supplemental confirmation"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications"
                },
                {
                    "name": "edr:Syscall",
                    "channel": "DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0038",
                    "external_id": "DC0038"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:41.733Z",
            "name": "Application Log Content",
            "description": "Application Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications. These logs are vital for monitoring application behavior and detecting malicious activities or anomalies. Examples: \n\n- Web Application Logs: These logs include information about requests, responses, errors, and security events (e.g., unauthorized access attempts).\n- Email Application Logs: Logs contain metadata about emails sent, received, or blocked (e.g., sender/receiver addresses, message IDs).\n- SaaS Application Logs: Activity logs include user logins, configuration changes, and access to sensitive resources.\n- Cloud Application Logs: Logs detail control plane activities, including API calls, instance modifications, and network changes.\n- System/Application Monitoring Logs: Logs provide insights into application performance, errors, and anomalies.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "m365:unified",
                    "channel": "CopilotInteraction"
                },
                {
                    "name": "android:logcat",
                    "channel": "Default IME active or bound to <pkg> (InputMethodManager reports imeId=<pkg>)"
                },
                {
                    "name": "android:logcat",
                    "channel": "Default IME changed/active: imeId=<pkg>, onStartInput/onFinishInput high frequency. TYPE_APPLICATION_OVERLAY|addView .* showing on top of package <otherPkg>"
                },
                {
                    "name": "android:logcat",
                    "channel": "Default IME active imeId=<pkg>; frequent onStartInput/commitText calls"
                },
                {
                    "name": "android:logcat",
                    "channel": "addView TYPE_APPLICATION_OVERLAY|TYPE_APPLICATION_ATTACHED_DIALOG shown over <target_pkg>"
                },
                {
                    "name": "android:logcat",
                    "channel": "Secure/Global reads of device_policy_manager, accessibility_enabled, default_vpn, always_on_vpn"
                },
                {
                    "name": "android:logcat",
                    "channel": "Task switch from browser/custom tab to handler immediately after OAuth return"
                },
                {
                    "name": "android:logcat",
                    "channel": "ACTION_OPEN_DOCUMENT_TREE / ACTION_OPEN_DOCUMENT invoked without user gesture or repeatedly in background"
                },
                {
                    "name": "Application Log",
                    "channel": "None"
                },
                {
                    "name": "Application:Mail",
                    "channel": "smtpd$.*$: .*from=[.*@internaldomain.com](mailto:.*@internaldomain.com) to=[.*@internaldomain.com](mailto:.*@internaldomain.com)"
                },
                {
                    "name": "Application:Mail",
                    "channel": "Inbound messages with anomalous headers, spoofed SPF/DKIM failures"
                },
                {
                    "name": "Application:Mail",
                    "channel": "Inbound emails containing hyperlinks from suspicious sources"
                },
                {
                    "name": "Application:Mail",
                    "channel": "Inbound email attachments logged from MTAs with suspicious metadata"
                },
                {
                    "name": "Application:Mail",
                    "channel": "Mismatch between authenticated username and From header in email"
                },
                {
                    "name": "Application:Mail",
                    "channel": "High-frequency inbound mail activity to a specific recipient address"
                },
                {
                    "name": "ApplicationLog:API",
                    "channel": "Docker/Kubernetes API access from external sources"
                },
                {
                    "name": "ApplicationLog:CallRecords",
                    "channel": "Outbound or inbound calls to high-risk or blocklisted numbers"
                },
                {
                    "name": "ApplicationLog:EntraIDPortal",
                    "channel": "DeviceRegistration events"
                },
                {
                    "name": "ApplicationLog:IIS",
                    "channel": "IIS W3C logs in C:\\inetpub\\logs\\LogFiles\\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)"
                },
                {
                    "name": "ApplicationLog:Ingress",
                    "channel": "Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes"
                },
                {
                    "name": "ApplicationLog:Intune/MDM Logs",
                    "channel": "Enrollment events (e.g., MDMDeviceRegistration)"
                },
                {
                    "name": "ApplicationLog:MailServer",
                    "channel": "Unexpected additions of sieve rules or filtering directives"
                },
                {
                    "name": "ApplicationLog:Outlook",
                    "channel": "Outlook client-level rule creation actions not consistent with normal user activity"
                },
                {
                    "name": "ApplicationLog:WebServer",
                    "channel": "/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors"
                },
                {
                    "name": "AWS:bedrock",
                    "channel": "GuardrailTrace"
                },
                {
                    "name": "AWS:bedrock",
                    "channel": "AgentTrace.FailureTrace"
                },
                {
                    "name": "AWS:bedrock",
                    "channel": "AgentTrace.ModelInvocationInput"
                },
                {
                    "name": "AWS:bedrock",
                    "channel": "AgentTrace.actionGroupInvocationInput"
                },
                {
                    "name": "AWS:bedrock",
                    "channel": "AgentTrace.knowledgeBaseLookupInput"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "SendEmail"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "InvokeModel"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services"
                },
                {
                    "name": "AWS:CloudWatch",
                    "channel": "Repeated crash pattern within container or instance logs"
                },
                {
                    "name": "AWS:CloudWatch",
                    "channel": "Elevated 5xx response rates in application logs or gateway layer"
                },
                {
                    "name": "azure:activity",
                    "channel": "Add role assignment / ElevateAccess / Create service principal"
                },
                {
                    "name": "azure:audit",
                    "channel": "App registrations or consent grants by abnormal users or at unusual times"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "ConsentGrant: Suspicious consent grants to non-approved or unknown applications"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Modify Conditional Access Policy"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Register PTA Agent or Modify AD FS trust"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Resource access initiated using application credentials, not user accounts"
                },
                {
                    "name": "casb:activity ",
                    "channel": "Subsequent sensitive data access or outbound transfer occurs in the same SaaS session "
                },
                {
                    "name": "docker:daemon",
                    "channel": "container_create,container_start"
                },
                {
                    "name": "docker:events",
                    "channel": "Container exited with non-zero code repeatedly in short period"
                },
                {
                    "name": "docker:runtime",
                    "channel": "execution of cloud CLI tool (e.g., aws, az) inside container"
                },
                {
                    "name": "EDR:detection",
                    "channel": "ThreatDetected, QuarantineLog"
                },
                {
                    "name": "EDR:detection",
                    "channel": "ThreatLog"
                },
                {
                    "name": "esxi:esxupdate",
                    "channel": "/var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log."
                },
                {
                    "name": "esxi:hostd",
                    "channel": "unexpected script/command invocations via hostd"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "unexpected script invocations producing long encoded strings"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Host daemon command log entries related to vib enumeration"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "New extension/module install with unknown vendor ID"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "vmkernel / OpenSLP logs for malformed requests"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "Symmetric crypto routines triggered for external session"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "ESXi process initiating asymmetric handshake with external host"
                },
                {
                    "name": "gcp:workspaceaudit",
                    "channel": "SendAs: Outbound messages with alias identities that differ from primary account"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Repeated or large UIPasteboard reads; background pasteboard access shortly before packaging"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "UIPasteboard read (general/string/data) by <bundle_id>; repeated reads or background access"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "UIWindow/UIView events indicating secure text entry focus, editingChanged bursts, unexpected firstResponder cycling"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Secure text entry focus and editingChanged bursts not typical for the app"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Presentation of credential-like view (UIAlertController with text fields / custom modal) not backed by system auth controller; frequent editingChanged in secureTextEntry fields"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "Repeated canOpenURL checks across diverse schemes (≥N within short window)"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "UIDocumentPickerViewController presented repeatedly without foreground interaction or with short dwell time"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "repeated sandbox denials related to restricted process/system interfaces consistent with process-table querying attempts"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "security-relevant kernel log messages indicating restricted system interface access attempts by app process (device-dependent visibility)"
                },
                {
                    "name": "journald:Application",
                    "channel": "Segfault or crash log entry associated with specific application binary"
                },
                {
                    "name": "journald:systemd",
                    "channel": "Repeated service restart attempts or unit failures"
                },
                {
                    "name": "kubernetes:orchestrator",
                    "channel": "Access to orchestrator logs containing credentials (Docker/Kubernetes logs)"
                },
                {
                    "name": "linux:cli",
                    "channel": "cleared or truncated .bash_history"
                },
                {
                    "name": "linux:syslog",
                    "channel": "usb * new|thunderbolt|pci .* added|block.*: new .* device"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Inbound messages from webmail services containing attachments or URLs"
                },
                {
                    "name": "linux:syslog",
                    "channel": "kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc."
                },
                {
                    "name": "linux:syslog",
                    "channel": "System daemons initiating encrypted sessions with unexpected destinations"
                },
                {
                    "name": "linux:syslog",
                    "channel": "milter configuration updated, transport rule initialized, unexpected script execution"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Repetitive HTTP 408, 500, or 503 errors logged within short timeframe"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads"
                },
                {
                    "name": "linux:syslog",
                    "channel": "processes binding to non-standard ports or sshd configured on unexpected port"
                },
                {
                    "name": "linux:syslog",
                    "channel": "system daemons initiating TLS sessions outside expected services"
                },
                {
                    "name": "linux:syslog",
                    "channel": "browser/office crash, segfault, abnormal termination"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Error/warning logs from services indicating load spike or worker exhaustion"
                },
                {
                    "name": "linux:syslog",
                    "channel": "SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain"
                },
                {
                    "name": "linux:syslog",
                    "channel": "suspicious DHCP lease assignment with unexpected DNS or gateway"
                },
                {
                    "name": "linux:syslog",
                    "channel": "opened document|clicked link|segfault|abnormal termination|sandbox"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Authentication attempts into finance-related servers from unusual IPs or times"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sshd sessions with unusual port forwarding parameters"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Non-standard processes negotiating SSL/TLS key exchanges"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Module registration or stacktrace logs indicating segmentation faults or unknown module errors"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Segfaults, kernel oops, or crashes in security software processes"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Emails containing cleartext secrets (password=, api_key=, token=) shared across internal/external domains"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Transport Rule Modification"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Admin Audit Logs, Transport Rules"
                },
                {
                    "name": "m365:exchange",
                    "channel": "MailDelivery: High-frequency delivery of messages or attachments to a single recipient"
                },
                {
                    "name": "m365:exchange",
                    "channel": "New-InboxRule: Automation that triggers abnormal forwarding or external link generation"
                },
                {
                    "name": "m365:exchange",
                    "channel": "MessageTrace logs"
                },
                {
                    "name": "m365:exchange",
                    "channel": "External sender message followed by user action involving links or attachments"
                },
                {
                    "name": "m365:mailboxaudit",
                    "channel": "Outlook rule creation or custom form deployment"
                },
                {
                    "name": "m365:messagetrace",
                    "channel": "AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail"
                },
                {
                    "name": "m365:messagetrace",
                    "channel": "X-MS-Exchange-Organization-AutoForwarded"
                },
                {
                    "name": "m365:purview",
                    "channel": "MailItemsAccessed & Exchange Audit"
                },
                {
                    "name": "m365:purview",
                    "channel": "MailItemsAccessed, Search-Mailbox events"
                },
                {
                    "name": "m365:teams",
                    "channel": "External chat request or new tenant communication preceding approval activity"
                },
                {
                    "name": "m365:unified",
                    "channel": "Authentication/account audit event identifying app-password or applicable legacy-authentication activity "
                },
                {
                    "name": "m365:unified",
                    "channel": "Unusual form activity within Outlook client, including load of non-default forms"
                },
                {
                    "name": "m365:unified",
                    "channel": "SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed"
                },
                {
                    "name": "m365:unified",
                    "channel": "SendOnBehalf, MessageSend, AttachmentPreviewed"
                },
                {
                    "name": "m365:unified",
                    "channel": "Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileAccessed: Access of email attachments by Office applications"
                },
                {
                    "name": "m365:unified",
                    "channel": "Creation or modification of inbox rule outside of normal user behavior"
                },
                {
                    "name": "m365:unified",
                    "channel": "Send/Receive: Inbound emails containing embedded or shortened URLs"
                },
                {
                    "name": "m365:unified",
                    "channel": "AppRegistration: Unexpected application registration or OAuth authorization"
                },
                {
                    "name": "m365:unified",
                    "channel": "MessageSend, MessageRead, or FileAttached events containing credential-like patterns"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-Mailbox, Add-InboxRule, RegisterWebhook"
                },
                {
                    "name": "m365:unified",
                    "channel": "ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA"
                },
                {
                    "name": "m365:unified",
                    "channel": "Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise"
                },
                {
                    "name": "m365:unified",
                    "channel": "Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder"
                },
                {
                    "name": "m365:unified",
                    "channel": "PurgeAuditLogs, Remove-MailboxAuditLog"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-CsOnlineUser or UpdateAuthPolicy"
                },
                {
                    "name": "m365:unified",
                    "channel": "New-InboxRule or Set-InboxRule events recorded in Exchange Online"
                },
                {
                    "name": "m365:unified",
                    "channel": "Transport rule or inbox rule creation events"
                },
                {
                    "name": "m365:unified",
                    "channel": "GAL Lookup or Address Book download"
                },
                {
                    "name": "m365:unified",
                    "channel": "Send/Receive: Inbound emails with attachments from suspicious or spoofed senders"
                },
                {
                    "name": "m365:unified",
                    "channel": "certificate added or modified in application credentials"
                },
                {
                    "name": "m365:unified",
                    "channel": "Unusual MFA requests or OAuth consent events temporally aligned with user-reported vishing call"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set federation settings on domain|Set domain authentication|Add federated identity provider"
                },
                {
                    "name": "m365:unified",
                    "channel": "SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-MailboxAutoReplyConfiguration: Unexpected rule changes creating impersonated replies"
                },
                {
                    "name": "m365:unified",
                    "channel": "SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities"
                },
                {
                    "name": "m365:unified",
                    "channel": "Read-only configuration review from GUI"
                },
                {
                    "name": "m365:unified",
                    "channel": "Modify Federation Settings or Update Authentication Policy"
                },
                {
                    "name": "m365:unified",
                    "channel": "Send/Receive: Unusual spikes in inbound messages to a single recipient"
                },
                {
                    "name": "m365:unified",
                    "channel": "PowerShell: Add-MailboxPermission"
                },
                {
                    "name": "m365:unified",
                    "channel": "Add-MailboxPermission or Set-ManagementRoleAssignment"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship"
                },
                {
                    "name": "m365:unified",
                    "channel": "Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship"
                },
                {
                    "name": "m365:unified",
                    "channel": "MailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teams"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileAccessed, FileDownloaded, SearchQueried"
                },
                {
                    "name": "m365:unified",
                    "channel": "Detection of hidden macro streams or SetHiddenAttribute actions"
                },
                {
                    "name": "m365:unified",
                    "channel": "RunMacro"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileUploaded or FileCopied events"
                },
                {
                    "name": "m365:unified",
                    "channel": "TeamsMessageAccess, TeamsExport, ExternalAppAccess"
                },
                {
                    "name": "m365:unified",
                    "channel": "TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileAccessed"
                },
                {
                    "name": "m365:unified",
                    "channel": "ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion"
                },
                {
                    "name": "m365:unified",
                    "channel": "MailItemsAccessed; AddedInboxRule; ConsentToApplication; SharingSet"
                },
                {
                    "name": "m365:unified",
                    "channel": "Set-AdminAuditLogConfig;New-ApplicationAccessPolicy;ConsentToApplication"
                },
                {
                    "name": "macos:jamf",
                    "channel": "RemoteCommandExecution"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Device attached|enumerated VID/PID"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Inbound email activity with suspicious domains or mismatched sender information"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "App/web server logs ingested via unified logging or filebeat (nginx/apache/node)."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Received messages with embedded or shortened URLs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Received messages containing embedded links or attachments from non-enterprise services"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "opendirectoryd crashes or abnormal authentication errors"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream cleared or truncated"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "quarantine or AV-related subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Inbound messages with attachments from suspicious domains"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Outgoing or incoming calls with non-standard caller IDs or unusual metadata"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Mail.app or third-party clients sending messages with mismatched From headers"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process crash, abort, code signing violations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Configuration profile modified or new profile installed"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Crash log entries for a process receiving malformed input or known exploit patterns"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Repetitive inbound email delivery activity logged within a short time window"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Application errors or resource contention from excessive frontend or script invocation"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "new DHCP configuration with anomalous DNS or router values"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Mail or AppleScript subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Anomalous keychain access attempts targeting payment credentials"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Abnormal terminations of com.apple.security.* or 3rd-party security daemons"
                },
                {
                    "name": "networkdevice:controlplane",
                    "channel": "Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "config push events"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "SIP REGISTER, INVITE, or unusual call destination metadata"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Failed authentication requests redirected to non-standard portals"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "PushNotificationSent"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Failed password or accepted password for SSH users"
                },
                {
                    "name": "saas:application",
                    "channel": "High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns."
                },
                {
                    "name": "saas:application",
                    "channel": "High-volume API calls or traffic via messaging or webhook service"
                },
                {
                    "name": "saas:audit",
                    "channel": "Actual send/share/upload/write operation"
                },
                {
                    "name": "saas:audit",
                    "channel": "Rule/ConfigChange: Auto-forward rules, delegate assignments, or changes to financial approval workflows"
                },
                {
                    "name": "saas:audit",
                    "channel": "Application added or consent granted: Integration persisting after original user disabled"
                },
                {
                    "name": "saas:box",
                    "channel": "User navigated to admin interface"
                },
                {
                    "name": "saas:collaboration",
                    "channel": "MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)"
                },
                {
                    "name": "saas:confluence",
                    "channel": "access.content"
                },
                {
                    "name": "saas:email",
                    "channel": "AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch"
                },
                {
                    "name": "saas:finance",
                    "channel": "Transaction/Transfer: Unusual or large transactions initiated outside business hours or by unusual accounts"
                },
                {
                    "name": "saas:github",
                    "channel": "Bulk access to multiple files or large volume of repo requests within short time window"
                },
                {
                    "name": "saas:gmail",
                    "channel": "SendEmail, OpenAttachment, ClickLink"
                },
                {
                    "name": "saas:googledrive",
                    "channel": "FileOpen / FileAccess: Event-driven script triggering on user file actions"
                },
                {
                    "name": "saas:googleworkspace",
                    "channel": "OAuth2 authorization grants / Admin role assignments"
                },
                {
                    "name": "saas:hubspot",
                    "channel": "contact_viewed, contact_exported, login"
                },
                {
                    "name": "saas:okta",
                    "channel": "Conditional Access policy rule modified or MFA requirement disabled"
                },
                {
                    "name": "saas:okta",
                    "channel": "MFAChallengeIssued"
                },
                {
                    "name": "saas:okta",
                    "channel": "WebUI access to administrator dashboard"
                },
                {
                    "name": "saas:okta",
                    "channel": "Federation configuration update or signing certificate change"
                },
                {
                    "name": "saas:okta",
                    "channel": "System API Call: user.read, group.read"
                },
                {
                    "name": "saas:okta",
                    "channel": "policy.rule.update;system.log.disable;admin.role.assign"
                },
                {
                    "name": "saas:openai",
                    "channel": "High volume of requests to /v1/chat/completions or /v1/images/generations"
                },
                {
                    "name": "saas:salesforce",
                    "channel": "DataExport, RestAPI, Login, ReportExport"
                },
                {
                    "name": "saas:slack",
                    "channel": "file_upload, message_send, message_click"
                },
                {
                    "name": "saas:slack",
                    "channel": "chat.postMessage, files.upload, or discovery API calls involving token/credential regex"
                },
                {
                    "name": "saas:slack",
                    "channel": "OAuth token use by unknown app client_id accessing private channels or files"
                },
                {
                    "name": "saas:slack",
                    "channel": "conversations.history, files.list, users.info, audit_logs"
                },
                {
                    "name": "saas:slack",
                    "channel": "xternal DM or workspace invite preceding credential or approval actions"
                },
                {
                    "name": "saas:Snowflake",
                    "channel": "QUERY: Large or repeated SELECT * queries to sensitive tables"
                },
                {
                    "name": "saas:teams",
                    "channel": "ChatMessageSent, ChatMessageEdited, LinkClick"
                },
                {
                    "name": "saas:zoom",
                    "channel": "unusual web session tokens and automation patterns during login"
                },
                {
                    "name": "saas:zoom",
                    "channel": "Unexpected contact interaction preceding follow-on admin requests"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Outlook errors loading or processing custom form templates"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Office Add-in load errors, abnormal loading context, or unsigned add-in warnings"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Outlook rule execution failure or abnormal rule execution context"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Outlook logs indicating failure to load or render HTML page in Home Page view"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "EventCode=1000"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "SCCM, Intune logs"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "VPN, Citrix, or remote access gateway logs showing external IP addresses"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Outlook rule creation, form load, or homepage redirection"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Exchange logs or header artifacts"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=6416"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=1102"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Changes to applicationhost.config or DLLs loaded by w3wp.exe"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Device started/installed (UMDF) GUIDs"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=1000"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=104"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=1341, 1342, 1020, 1063"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware write session initiated without corresponding change ticket reference"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "program download session logged without corresponding change ticket reference"
                },
                {
                    "name": "syslog:daemon",
                    "channel": "Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout"
                },
                {
                    "name": "webserver:applog",
                    "channel": "Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging"
                },
                {
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "edr:TelemetryCompare",
                    "channel": "process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing"
                },
                {
                    "name": "historian:applog",
                    "channel": "historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients"
                },
                {
                    "name": "scada:applog",
                    "channel": "device communication-loss alarm generated within detection window of a corresponding network flood alert"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window"
                },
                {
                    "name": "vpn:applog",
                    "channel": "session duration or command activity inconsistent with documented vendor support session profiles"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "configuration change logged without corresponding change ticket reference following anomalous authentication"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) SET to alarm threshold Object Identifier (OID) from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "unexpected listening port or routing table change following firmware update event"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "unexpected restart or crash coinciding with anomalous traffic pattern on management interface"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list"
                },
                {
                    "name": "opc:applog",
                    "channel": "client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests"
                },
                {
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list"
                },
                {
                    "name": "opc:applog",
                    "channel": "Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin"
                },
                {
                    "name": "opcua:AuditEvent",
                    "channel": "OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write"
                },
                {
                    "name": "opc:applog",
                    "channel": "write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range"
                },
                {
                    "name": "opc:applog",
                    "channel": "client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset"
                },
                {
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree"
                },
                {
                    "name": "opc:applog",
                    "channel": "command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "mode-change session logged without corresponding change ticket reference"
                },
                {
                    "name": "serialgw:syslog",
                    "channel": "serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware update mode entry logged without corresponding change ticket reference"
                },
                {
                    "name": "scada:applog",
                    "channel": "write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth"
                },
                {
                    "name": "scada:applog",
                    "channel": "parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail"
                },
                {
                    "name": "scada:applog",
                    "channel": "command issued to device_ip with no corresponding state-change confirmation received within command confirmation window"
                },
                {
                    "name": "otndr:BehaviorAlert",
                    "channel": "device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction"
                },
                {
                    "name": "device:VendorLog",
                    "channel": "protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "full upload session outside backup window schedule without documented backup purpose"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "online edit session logged without corresponding change ticket reference"
                },
                {
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory"
                },
                {
                    "name": "vendorapp:ApplicationLog",
                    "channel": "Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware session initiated outside maintenance window schedule without change ticket reference"
                },
                {
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "device restart command initiated outside change control window by account not in approved engineer list"
                },
                {
                    "name": "webproxy:applog",
                    "channel": "file download from domain not matching verified vendor Transport Layer Security (TLS) certificate/domain history, immediately preceding the anomalous process spawn"
                },
                {
                    "name": "webserver:applog",
                    "channel": "Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0067",
                    "external_id": "DC0067"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:46.287Z",
            "name": "Logon Session Creation",
            "description": "The successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associated with that user account. This data is crucial for tracking authentication events and identifying potential unauthorized access. Examples: \n\n- Windows Systems\n    - Event ID: 4624\n        - Logon Type: 2 (Interactive) or 10 (Remote Interactive via RDP).\n        - Account Name: JohnDoe\n        - Source Network Address: 192.168.1.100\n        - Authentication Package: NTLM\n- Linux Systems\n    - /var/log/utmp or /var/log/wtmp:\n        - Log format: login user [tty] from [source_ip]\n        - User: jane\n        - IP: 10.0.0.5\n        - Timestamp: 2024-12-28 08:30:00\n- macOS Systems\n    - /var/log/asl.log or unified logging framework:\n        - Log: com.apple.securityd: Authentication succeeded for user 'admin'\n- Cloud Environments\n    - Azure Sign-In Logs:\n        - Activity: Sign-in successful\n        - Client App: Browser\n        - Location: Unknown (Country: X)\n- Google Workspace\n    - Activity: Login\n        - Event Type: successful_login\n        - Source IP: 203.0.113.55",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "device:auth",
                    "channel": "SSH/Telnet/console or vendor remote-management session "
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "capset or setns"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ConsoleLogin, AssumeRole, ListResources"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ConsoleLogin"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "Web console logins using session cookies without corresponding MFA event"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "Temporary security credentials used to authenticate into management console or APIs"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "AWS ConsoleLogin, StartSession"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "GetConsoleOutput"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "sudden role assumption after credential file access"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity"
                },
                {
                    "name": "azure:ad",
                    "channel": "SignInEvents"
                },
                {
                    "name": "azure:signin",
                    "channel": "UserLoginSuccess, TokenIssued"
                },
                {
                    "name": "azure:signin",
                    "channel": "Microsoft.Compute/virtualMachines/serialConsole/connect/action"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Abnormal sign-in from scripting tools (PowerShell, AADInternals)"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Suspicious login to cloud mailbox system"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "InteractiveUser, ServicePrincipalSignIn"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "InteractiveUser, NonInteractiveUser"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "UserLogin, ConditionalAccessPolicyEvaluated"
                },
                {
                    "name": "CloudTrail:Signin",
                    "channel": "SAML login without corresponding IdP authentication log"
                },
                {
                    "name": "esxi:auth",
                    "channel": "Shell login or escalation"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "vim.fault.*, DCUI login, SSH shell"
                },
                {
                    "name": "gcp:audit",
                    "channel": "LoginAudit, DriveAudit"
                },
                {
                    "name": "gcp:audit",
                    "channel": "cloud.ssh.publicKey.inserted, compute.instances.osLogin"
                },
                {
                    "name": "gcp:audit",
                    "channel": "admin.googleapis.com"
                },
                {
                    "name": "idp:session ",
                    "channel": "New session established from source/device inconsistent with account baseline "
                },
                {
                    "name": "linux:auth",
                    "channel": "User login event followed by unexpected process tree"
                },
                {
                    "name": "linux:syslog",
                    "channel": "auth.log/secure.log; SSH or console session context "
                },
                {
                    "name": "linux:syslog",
                    "channel": "sshd: Accepted password/publickey"
                },
                {
                    "name": "linux:syslog",
                    "channel": "authentication success after file access"
                },
                {
                    "name": "linux:syslog",
                    "channel": "auth.log / secure.log"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Accepted publickey/password for * from * port * ssh2"
                },
                {
                    "name": "linux:syslog",
                    "channel": "None"
                },
                {
                    "name": "Logon Session",
                    "channel": "None"
                },
                {
                    "name": "m365:sharepoint",
                    "channel": "File access with forged or anomalous SAML claims"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "SignInSuccess, RoleAssignmentRead"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "Token usage events with device/user mismatch"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "UserLogin: Discovery operations shortly after account logins from new geolocations"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "UserLoggedIn"
                },
                {
                    "name": "m365:unified",
                    "channel": "UserLoggedIn"
                },
                {
                    "name": "m365:unified",
                    "channel": "ViewAdminReport"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "UserLoggedIn"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Authentication inconsistencies where commands are executed without corresponding login events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "authentication"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Session reuse without new auth event"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Access to Keychain items or browser credential stores"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Keychain or user login post-access"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "authentication plugin load or modification events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loginwindow or sshd successful login events"
                },
                {
                    "name": "networkdevice:auth",
                    "channel": "SSH/Telnet/console authentication and session creation"
                },
                {
                    "name": "networkdevice:Firewall",
                    "channel": "Login from untrusted IP, or new admin account accessing firewall console/API"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Missing new login event but session activity continues"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Accepted publickey for user from unusual IP or without tty"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "simultaneous or anomalous logon sessions across multiple systems"
                },
                {
                    "name": "Okta:SystemLog",
                    "channel": "user.authentication.sso, app.oauth.grant"
                },
                {
                    "name": "saas:access",
                    "channel": "Multiple concurrent logins using same cookie from different locations"
                },
                {
                    "name": "saas:auth",
                    "channel": "LoginSuccess, APIKeyUse, AdminAction"
                },
                {
                    "name": "saas:auth",
                    "channel": "Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens"
                },
                {
                    "name": "saas:confluence",
                    "channel": "logon"
                },
                {
                    "name": "saas:github",
                    "channel": "Login from unusual IP, device fingerprint, or location; access token creation from new client"
                },
                {
                    "name": "saas:okta",
                    "channel": "user.session.start"
                },
                {
                    "name": "saas:okta",
                    "channel": "session.token.reuse"
                },
                {
                    "name": "saas:session ",
                    "channel": "New authenticated session associated with changed source/client context "
                },
                {
                    "name": "saas:zoom",
                    "channel": "Zoom Admin Dashboard accessed from unfamiliar IP/device"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4624, 4648"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Anomalous logon without MFA enforcement"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4624"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sudo/su success for Industrial Control Systems (ICS) service account UID without the expected automated invocation pattern"
                },
                {
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts"
                },
                {
                    "name": "wireless:radius",
                    "channel": "Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory"
                },
                {
                    "name": "syslog:auth",
                    "channel": "sshd Accepted for username matching default vendor credential list from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "syslog:auth",
                    "channel": "sshd Accepted for username matching default or hardcoded credential patterns from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
            "created": "2022-05-11T16:22:58.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0108",
                    "external_id": "DC0108"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:39.111Z",
            "name": "Device Alarm",
            "description": "This includes alarms associated with unexpected device functions, such as shutdowns, restarts, failures, or configuration changes",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Operational Databases",
                    "channel": "None"
                },
                {
                    "name": "alarmserver:ApplicationLog",
                    "channel": "alarm suppression Application Programming Interface (API) call logged without operator session identifier (ID)"
                },
                {
                    "name": "alarmserver:ApplicationLog",
                    "channel": "alarm class disabled or suppressed Application Programming Interface (API) event logged without operator_id field populated"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device reboot/restart alarm within firmware update window of the flagged transfer session"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device reboot within firmware update window of the flagged transfer session"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device receives commands from two distinct master identities within a short window"
                },
                {
                    "name": "device:VendorLog",
                    "channel": "measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference"
                },
                {
                    "name": "device:VendorLog",
                    "channel": "measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device mode-change alarm generated without corresponding operator_id entry within mode change ack window"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "alarm threshold configuration changed without operator_ack or change ticket reference"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment"
                },
                {
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device offline alarm coinciding with switch port admin-down syslog for that port"
                },
                {
                    "name": "processsensor:RedundantComparison",
                    "channel": "device-reported value for a tag diverges from independently measured value for same physical quantity by more than sensor tolerance threshold"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0029",
                    "external_id": "DC0029"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:47.221Z",
            "name": "Script Execution",
            "description": "The execution of a text file that contains code via the interpreter.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Script",
                    "channel": "None"
                },
                {
                    "name": "m365:office",
                    "channel": "VBA auto_open, auto_close, or document_open events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'eventMessage contains \"python\"'"
                },
                {
                    "name": "linux:syslog",
                    "channel": "/var/log/syslog"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=1502, 1503"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream --predicate 'eventMessage contains \"wscript\" OR \"vbs\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "osascript or AppleScript invocation modifying UI"
                },
                {
                    "name": "networkdevice:runtime",
                    "channel": "runtime"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "boot"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "AppleScript creating login item via 'System Events' dictionary"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=4103, 4104, 4105, 4106"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing"
                },
                {
                    "name": "ApplicationLogs:SQL",
                    "channel": "Stored procedure creation or modification with shell invocation (e.g., system(), exec())"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=launchservices"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled"
                },
                {
                    "name": "EDR:scriptblock",
                    "channel": "Process Tree + Script Block Logging"
                },
                {
                    "name": "linux:syslog",
                    "channel": "boot logs"
                },
                {
                    "name": "m365:defender",
                    "channel": "ScriptBlockLogging + AMSI"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream with predicate 'eventMessage CONTAINS \"osascript\"'"
                },
                {
                    "name": "etw:Microsoft-Antimalware-Scan-Interface",
                    "channel": "Amsi/Script content + API verdicts during in-memory staging"
                },
                {
                    "name": "esxi:shell",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=4016, 5312"
                },
                {
                    "name": "auditd:PROCTITLE",
                    "channel": "scripting loop invoking sleep/ping"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic"
                },
                {
                    "name": "macos:syslog",
                    "channel": "system.log, asl.log"
                },
                {
                    "name": "macos:osquery",
                    "channel": "exec: Unexpected execution of osascript or AppleScript targeting sensitive apps"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.Security or com.apple.applescript"
                },
                {
                    "name": "azure:activity",
                    "channel": "Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads"
                },
                {
                    "name": "EDR:AMSI",
                    "channel": "Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "osascript, AppleScript, or Python execution triggered immediately after HID connection"
                },
                {
                    "name": "m365:unified",
                    "channel": "Scripted Activity"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter making sequential Industrial Control Systems (ICS) protocol reads with output to file, by User Identifier (UID) not in authorized scripting UIDs"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0078",
                    "external_id": "DC0078"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:50.375Z",
            "name": "Network Traffic Flow",
            "description": "Summarized network packet data that captures session-level details such as source/destination IPs, ports, protocol types, timestamps, and data volume, without storing full packet payloads. This is commonly used for traffic analysis, anomaly detection, and network performance monitoring.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "NSM:Flow",
                    "channel": "Device-to-broker flow metadata"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/connect"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "socket/connect syscalls"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "connect or sendto system call with burst pattern"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ioctl: Changes to wireless network interfaces (up, down, reassociate)"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "CreateTrafficMirrorSession or ModifyTrafficMirrorTarget"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "egress > 90th percentile or frequent connection reuse"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "VPC/NSG flow logs for pod/instance egress to Internet or metadata"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Outbound data flows"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Unusual volume of inbound packets from single source across short time interval"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Outbound flow logs to known mining pools"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "source instance sends large volume of traffic in short window"
                },
                {
                    "name": "AWS:VPCFlowLogs",
                    "channel": "Large outbound UDP traffic to multiple public reflector IPs"
                },
                {
                    "name": "container:cni",
                    "channel": "Outbound network traffic to mining proxies"
                },
                {
                    "name": "containerd:runtime",
                    "channel": "container-level outbound traffic events"
                },
                {
                    "name": "dns:query",
                    "channel": "Outbound resolution to hidden service domains (e.g., `.onion`)"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "CLI network calls"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "esxcli network vswitch or DNS resolver configuration updates"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "DNS resolution events leading to outbound traffic on unexpected ports"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "/var/log/syslog.log"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "Frequent DNS queries with high entropy names or NXDOMAIN results"
                },
                {
                    "name": "esxi:syslog",
                    "channel": "Frequent DNS resolution of same domain with rotating IPs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "/var/log/vmkernel.log"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "HTTPS traffic to repository domains"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "None"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "egress log analysis"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "egress logs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "network flows to external cloud services"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "port 22 access"
                },
                {
                    "name": "esxi:vobd",
                    "channel": "Network Events"
                },
                {
                    "name": "esxi:vpxa",
                    "channel": "connection attempts and data transmission logs"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "ESXi service connections on unexpected ports"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "TLS session established by ESXi service to unapproved endpoint"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "None"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "ESXi processes relaying traffic via SSH or unexpected ports"
                },
                {
                    "name": "iptables:LOG",
                    "channel": "TCP connections"
                },
                {
                    "name": "iptables:LOG",
                    "channel": "OUTBOUND"
                },
                {
                    "name": "linux:osquery",
                    "channel": "socket_events"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Multiple IP addresses assigned to the same domain in rapid sequence"
                },
                {
                    "name": "m365:defender",
                    "channel": "NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch"
                },
                {
                    "name": "M365Defender:DeviceNetworkEvents",
                    "channel": "NetworkConnection: bytes_sent >> bytes_received anomaly"
                },
                {
                    "name": "macos:osquery",
                    "channel": "socket_events"
                },
                {
                    "name": "macos:osquery",
                    "channel": "query: Historical list of associated SSIDs compared against baseline"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Suspicious outbound traffic from browser binary to non-standard domains"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "HTTPS POST to known webhook URLs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "com.apple.network"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "outbound TCP/UDP traffic over unexpected port"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "tcp/udp"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Suspicious anomalies in transmitted data integrity during application network operations"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "HTTPS POST requests to pastebin.com or similar"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Firewall/PF anchor load or rule change events."
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "sudden burst in outgoing packets from same PID"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "forwarded encrypted traffic"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "ARP table updates inconsistent with expected gateway or DHCP lease assignments"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "networkd or com.apple.network"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log stream 'eventMessage contains \"dns_request\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Outbound UDP spikes to external reflector IPs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "High entropy domain queries with multiple NXDOMAINs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Rapid domain-to-IP resolution changes for same domain"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Firewall rule enable/disable or listen socket changes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Outbound connections from IDE processes to marketplace/tunnel domains"
                },
                {
                    "name": "NetFlow:Flow",
                    "channel": "new outbound connections from exploited process tree"
                },
                {
                    "name": "Network Traffic",
                    "channel": "None"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "flow records"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Config/ACL changes, line vty transport input changes, telnet/ssh/http(s) enable, image/feature module changes."
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Config change: CLI/NETCONF/SNMP – 'monitor session', 'mirror port'"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads"
                },
                {
                    "name": "NetworkProxy:HTTPSFlow",
                    "channel": "bytes_out in range $CredentialDumpMin$..$CredentialDumpMax$ to dest NOT IN $AppCDNList$ within $ExfilWindow$ of MDM jailbreak detection — credential dump size range (small but dense) to novel destination indicates Keychain exfiltration"
                },
                {
                    "name": "NIDS:Flow",
                    "channel": "session stats with bytes_out > bytes_in"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Internal connection logging"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "new connections from exploited lineage"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Outbound Connection"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Inbound on ports 5985/5986"
                },
                {
                    "name": "NSM:firewall",
                    "channel": "inbound connection to port 5900"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "Outbound connections to 139/445 to multiple destinations"
                },
                {
                    "name": "NSM:Firewall",
                    "channel": "pf firewall logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Source/destination/port/session metadata"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Client/broker flow metadata"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Client/broker connection metadata and periodicity"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "External DNS/HTTPS/TLS flow bypassing approved resolver/proxy"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Client-to-resolver or client-to-DoH endpoint flow"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Device-to-resolver/DoH destination flow"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected flows between segmented networks or prohibited ports"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time outbound connections to package registries or unknown hosts immediately after restore/build"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time egress to new registries/CDNs post-install/build"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time egress to non-approved registries after dependency install"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large outbound data flows or long-duration connections"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "connection metadata"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "LEASE_GRANTED"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "MAC not in allow-list acquiring IP (DHCP)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "pf firewall logs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Inter-segment traffic"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "None"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Long-lived or hijacked SSH sessions maintained with no active user activity"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Abnormal browser traffic volume or destination"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound requests to domains not previously resolved or associated with phishing campaigns"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "NetFlow/Zeek conn.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Flow records with entropy signatures resembling symmetric encryption"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "flow records"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Source/destination IP translation inconsistent with intended policy"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Sudden spike in incoming flows to web service ports from single/multiple IPs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "port 5900 inbound"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TCP port 5900 open"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "NetFlow/sFlow/PCAP"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound Network Flow"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Device-to-Device Deployment Flows"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound traffic from suspicious new processes post-attachment execution"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound traffic to mining pools or proxies"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Session records with TLS-like byte patterns"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Unexpected route changes or duplicate gateway advertisements"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success."
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time egress to non-approved update hosts right after install/update"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New outbound flows to non-approved vendor hosts post install"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New/rare egress to non-approved update hosts after install"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large outbound HTTPS uploads to repo domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "alert log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound flow records"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "network_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "session stats with bytes_out > bytes_in"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "High volumes of SYN/ACK packets with unacknowledged TCP handshakes"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log + ssl.log with Tor fingerprinting"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Relayed session pathing (multi-hop)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound TCP SYN or UDP to multiple ports/hosts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Gratuitous ARP replies with mismatched IP-MAC binding"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound UDP floods targeting common reflection services with spoofed IP headers"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Connection Tracking"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Flow Creation (NetFlow/sFlow)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log, icmp.log"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "uncommon ports"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "alternate ports"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "conn.log or flow data"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "High volume flows with incomplete TCP sessions or single-packet bursts"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time egress from host after new install to unknown update endpoints"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "First-time egress to unknown registries/mirrors immediately after install"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "New egress from app just installed to unknown update endpoints"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound connection to mining pool port (3333, 4444, 5555)"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound traffic to mining pool upon container launch"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Flow records with RSA key exchange on unexpected port"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "sustained outbound HTTPS sessions with high data volume"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Connections from IDE hosts to marketplace/tunnel domains"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "large HTTPS outbound uploads"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TCP port 22 traffic"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "Application-layer protocol traffic exhibiting beacon-like periodicity, anomalous session structure, or protocol misuse patterns"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "App-attributed traffic exhibits multi-destination fan-out, sustained session bridging, or SOCKS-like relay behavior inconsistent with normal client-only mobile communication"
                },
                {
                    "name": "NSX:FlowLogs",
                    "channel": "network_flow: bytes_out >> bytes_in to external"
                },
                {
                    "name": "PF:Logs",
                    "channel": "outbound flows with bytes_out >> bytes_in"
                },
                {
                    "name": "PF:Logs",
                    "channel": "high out:in ratio or fixed-size periodic flows"
                },
                {
                    "name": "PF:Logs",
                    "channel": "External traffic to remote access services"
                },
                {
                    "name": "saas:api",
                    "channel": "Webhook registrations or repeated POST activity"
                },
                {
                    "name": "snmp:config",
                    "channel": "Configuration change traps or policy enforcement failures"
                },
                {
                    "name": "SNMP:DeviceLogs",
                    "channel": "Unexpected NAT translation statistics or rule insertion events"
                },
                {
                    "name": "TelecomLogs:MobilityEvents",
                    "channel": "Unexpected location resolution events or abnormal subscriber tracking requests"
                },
                {
                    "name": "TelecomLogs:MobilityEvents",
                    "channel": "Unexpected subscriber tracking or abnormal mobility/location resolution activity"
                },
                {
                    "name": "VPCFlowLogs:All",
                    "channel": "High volume internal traffic with low entropy indicating looped or malicious DoS script"
                },
                {
                    "name": "vpxd.log",
                    "channel": "API communication"
                },
                {
                    "name": "Windows Firewall Log",
                    "channel": "SMB over high port"
                },
                {
                    "name": "wineventlog:dhcp",
                    "channel": "DHCP Lease Granted"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                    "channel": "EventCode=2004, 2005, 2006"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "ARP cache modification attempts observed through event tracing or security baselines"
                },
                {
                    "name": "WLANLogs:Association",
                    "channel": "Multiple APs advertising the same SSID but with different BSSID/MAC or encryption type"
                },
                {
                    "name": "android:EnterpriseNetworkLog",
                    "channel": "DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata"
                },
                {
                    "name": "iOS:NetworkExtension",
                    "channel": "NEFilterFlow / per-app VPN / secure-web-gateway flow metadata"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Trivial File Transfer Protocol (TFTP) session to device Internet Protocol (IP) address from source not in engineering workstation list followed by device reboot syslog within firmware transfer window"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): egress flow on port 443/80/8080/53 from Industrial Control Systems (ICS) host in no-external-connectivity role list to destination not in approved vendor domains"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): first-seen connection from a source to an Industrial Control System (ICS) device outside the documented approved communication matrix"
                },
                {
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory"
                },
                {
                    "name": "networkdevice:snmp",
                    "channel": "Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change"
                },
                {
                    "name": "NSM:Content",
                    "channel": "non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP)"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "device_ip generates no outbound unsolicited traffic while responding normally to inbound polls"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "embedded device_ip initiates outbound connection on port 443/80/8080 to destination outside documented operational profile"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "unsolicited response message source identity does not match the enrolled device for those data points"
                },
                {
                    "name": "NSM:Content",
                    "channel": "device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket"
                },
                {
                    "name": "NSM:Content",
                    "channel": "write function code to output register address range from source not in approved write sources"
                },
                {
                    "name": "NSM:Content",
                    "channel": "deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure"
                },
                {
                    "name": "perimeter:firewall",
                    "channel": "inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space"
                },
                {
                    "name": "wireless:spectrum",
                    "channel": "Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence"
                },
                {
                    "name": "zeek:ssl",
                    "channel": "Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0002",
                    "external_id": "DC0002"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:46.928Z",
            "name": "User Account Authentication",
            "description": "An attempt (successful and failed login attempts) by a user, service, or application to gain access to a network, system, or cloud-based resource. This typically involves credentials such as passwords, tokens, multi-factor authentication (MFA), or biometric validation.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "saas:audit ",
                    "channel": "Successful application-specific/legacy credential authentication where exposed "
                },
                {
                    "name": "auditd:AUTH",
                    "channel": "pam_unix or pam_google_authenticator invoked repeatedly within short interval"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "pam_authenticate, sshd"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execution of ssh, scp, or sftp using previously unseen credentials or keys"
                },
                {
                    "name": "auditd:USER_LOGIN",
                    "channel": "USER_AUTH"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "AssumeRole or ConsoleLogin with repeated MFA failures followed by repeated MFA requests"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "sts:GetFederationToken"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "AssumeRoleWithWebIdentity"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "AWS IAM: ListUsers, ListRoles"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "eventName=ConsoleLogin | eventType=AwsConsoleSignIn"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ConsoleLogin or AssumeRole"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access "
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Success logs from high-risk accounts"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Multiple MFA challenge requests without successful primary login"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Operation=UserLogin"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Unusual Token Usage or Application Consent"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "OperationName=SetDomainAuthentication OR Set-FederatedDomain"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Sign-in with unfamiliar location/device + portal navigation"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Login from newly created account"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Interactive/Non-Interactive Sign-In"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Reset password or download key from portal"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "status = failure"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Sign-in logs"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "SigninSuccess"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Failure Reason + UserPrincipalName"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Sign-in activity"
                },
                {
                    "name": "azure:signinlogs",
                    "channel": "Sign-in logs / audit events"
                },
                {
                    "name": "esxi:auth",
                    "channel": "interactive shell or SSH access preceding storage enumeration"
                },
                {
                    "name": "esxi:auth",
                    "channel": "/var/log/auth.log"
                },
                {
                    "name": "esxi:auth",
                    "channel": "SSH session/login"
                },
                {
                    "name": "esxi:vpxa",
                    "channel": "user login from unexpected IP or non-admin user role"
                },
                {
                    "name": "esxi:vpxd",
                    "channel": "/var/log/vmware/vpxd.log"
                },
                {
                    "name": "ESXiLogs:authlog",
                    "channel": "Unexpected login followed by encoding commands"
                },
                {
                    "name": "gcp:audit",
                    "channel": "drive.activity"
                },
                {
                    "name": "gcp:audit",
                    "channel": "login.event"
                },
                {
                    "name": "gcp:audit",
                    "channel": "Sign-in logs / audit events"
                },
                {
                    "name": "gcp:workspaceaudit",
                    "channel": "Token Generation via Domain Delegation"
                },
                {
                    "name": "GCPAuditLogs:login.googleapis.com",
                    "channel": "Failed sign-in events"
                },
                {
                    "name": "idp:authentication ",
                    "channel": "Successful authentication associated with legacy/application-specific credential flow "
                },
                {
                    "name": "kubernetes:apiserver",
                    "channel": "get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts"
                },
                {
                    "name": "kubernetes:apiserver",
                    "channel": "authentication.k8s.io/v1beta1"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "Failed login"
                },
                {
                    "name": "kubernetes:audit",
                    "channel": "authentication.k8s.io"
                },
                {
                    "name": "linux:auth",
                    "channel": "sshd login"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sudo/date/timedatectl execution by non-standard users"
                },
                {
                    "name": "linux:syslog",
                    "channel": "SSH failed login"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Failed password for invalid user"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sshd[pid]: Failed password"
                },
                {
                    "name": "linux:syslog",
                    "channel": "authentication and authorization events during environmental validation phase"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Logon failure"
                },
                {
                    "name": "m365:exchange",
                    "channel": "FailedLogin"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "Sign-in from anomalous location or impossible travel condition"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "UserLoginSuccess"
                },
                {
                    "name": "m365:signinlogs",
                    "channel": "Unusual sign-in from service principal to user mailbox"
                },
                {
                    "name": "m365:unified",
                    "channel": "Delegated permission grants without user login event"
                },
                {
                    "name": "m365:unified",
                    "channel": "login using refresh_token with no preceding authentication context"
                },
                {
                    "name": "m365:unified",
                    "channel": "Sign-in logs"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "successful sudo or authentication for account not normally associated with admin actions"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Login success without MFA step"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log show --predicate 'eventMessage contains \"Authentication\"'"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "User credential prompt events without associated trusted installer package"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Login failure / authorization denied"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "auth"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Login Window and Authd errors"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "authd"
                },
                {
                    "name": "network:auth",
                    "channel": "repeated successful authentications with previously unknown accounts or anomalous password acceptance"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "config access, authentication logs"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "User privilege escalation to level 15/root prior to destructive commands"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "authorization/accounting logs"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Failed and successful logins to network devices outside approved admin IP ranges"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Privileged login followed by destructive format command"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "admin login events"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Privileged login followed by destructive command sequence"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "AAA, RADIUS, or TACACS authentication"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "authentication logs"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "AAA or TACACS authentication failures"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "authentication & authorization"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "login failed"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Accepted password or publickey for user from remote IP"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Repeated failed authentication attempts or replay patterns"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "Successful login without expected MFA challenge"
                },
                {
                    "name": "NSM:Connections",
                    "channel": "sshd or PAM logins"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "TGS-REQ and AS-REQ seen for new user shortly after domain-modifying process"
                },
                {
                    "name": "Okta:authn",
                    "channel": "authentication_failure"
                },
                {
                    "name": "Okta:SystemLog",
                    "channel": "eventType: user.authentication.sso, app.oauth2.token.grant"
                },
                {
                    "name": "saas-app:auth",
                    "channel": "login_failure"
                },
                {
                    "name": "saas:audit",
                    "channel": "Repeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies."
                },
                {
                    "name": "saas:auth",
                    "channel": "signin_failed"
                },
                {
                    "name": "saas:googleworkspace",
                    "channel": "API access without user login"
                },
                {
                    "name": "saas:googleworkspace",
                    "channel": "Accessed third-party credential management service"
                },
                {
                    "name": "saas:googleworkspace",
                    "channel": "login with reused session token and mismatched user agent or IP"
                },
                {
                    "name": "saas:googleworkspace",
                    "channel": "Access via OAuth credentials with unusual scopes or from anomalous IPs"
                },
                {
                    "name": "saas:MDM",
                    "channel": "Authentication events to device management or enterprise mobility management consoles"
                },
                {
                    "name": "saas:MDM",
                    "channel": "Authentication events to Apple iCloud or enterprise device management services"
                },
                {
                    "name": "saas:okta",
                    "channel": "session.impersonation.start"
                },
                {
                    "name": "saas:okta",
                    "channel": "Unusual OAuth app requesting message-read scopes for Slack/Teams/Jira"
                },
                {
                    "name": "saas:okta",
                    "channel": "authentication_failure"
                },
                {
                    "name": "saas:okta",
                    "channel": "Sign-in logs / audit events"
                },
                {
                    "name": "saas:okta",
                    "channel": "user.account.reset_password; user.mfa.factor.activate; app.oauth2.authorize"
                },
                {
                    "name": "saas:salesforce",
                    "channel": "API login using access_token without login history"
                },
                {
                    "name": "saas:salesforce",
                    "channel": "Login"
                },
                {
                    "name": "User Account",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4625"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4769, 1200, 1202"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4768, 4769, 4770"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4769"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4776, 4625"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4625, 4771, 4648"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4648"
                },
                {
                    "name": "idp:AuditLog",
                    "channel": "App authentication flow instrumentation or IdP sign-in/audit events"
                },
                {
                    "name": "syslog:auth",
                    "channel": "sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR"
                },
                {
                    "name": "networkdevice:aaa",
                    "channel": "TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706",
            "created": "2022-09-23T16:34:00.912Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0110",
                    "external_id": "DC0110"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:42.721Z",
            "name": "Asset Inventory",
            "description": "This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Asset",
                    "channel": "None"
                },
                {
                    "name": "assetinventory:MasterAddress",
                    "channel": "command traffic uses master/station address not in registered master addresses"
                },
                {
                    "name": "assetinventory:ProgramHash",
                    "channel": "post-transfer program hash does not match last authorized program baseline"
                },
                {
                    "name": "assetinventory:ProgramSize",
                    "channel": "device program size/block count increases without corresponding change ticket reference"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0004",
                    "external_id": "DC0004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:40.707Z",
            "name": "Firmware Modification",
            "description": "Changes made to firmware, which may include its settings, configurations, or underlying data. This can encompass alterations to the Master Boot Record (MBR), Volume Boot Record (VBR), or other firmware components critical to system boot and functionality. Such modifications are often indicators of adversary activity, including malware persistence and system compromise. Examples: \n\n- Changes to Master Boot Record (MBR): Modifying the MBR to load malicious code during the boot process.\n- Changes to Volume Boot Record (VBR): Altering the VBR to redirect boot processes to malicious locations.\n- Firmware Configuration Changes: Modifying BIOS/UEFI settings such as disabling Secure Boot.\n- Firmware Image Tampering: Updating firmware with a malicious or unauthorized image.\n- Logs or Errors Indicating Firmware Changes: Logs showing unauthorized firmware updates or checksum mismatches.\n\nThis data component can be collected through the following measures:\n\n- BIOS/UEFI Logs: Enable and monitor BIOS/UEFI logs to capture settings changes or firmware updates.\n- Firmware Integrity Monitoring: Use tools or firmware security features to detect changes to firmware components.\n- Endpoint Detection and Response (EDR) Solutions: Many EDR platforms can detect abnormal firmware activity, such as changes to MBR/VBR or unauthorized firmware updates.\n- File System Monitoring: Monitor changes to MBR/VBR-related files using tools like Sysmon or auditd.\n    - Windows Example (Sysmon): Monitor Event ID 7 (Raw disk access).\n    - Linux Example (auditd): `auditctl -w /dev/sda -p wa -k firmware_modification`\n- Network Traffic Analysis: Capture firmware updates downloaded over the network, particularly from untrusted sources. Use network monitoring tools like Zeek or Wireshark to analyze firmware-related traffic.\n- Secure Boot Logs: Collect and analyze Secure Boot logs for signs of tampering or unauthorized configurations. Example: Use PowerShell to retrieve Secure Boot settings on Windows: `Confirm-SecureBootUEFI`\n- Vendor-Specific Firmware Tools: Many hardware vendors provide tools for firmware integrity checks.Examples:\n    - Intel Platform Firmware Resilience (PFR).\n    - Lenovo UEFI diagnostics.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Firmware",
                    "channel": "None"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Image Upgrade / Configuration Change"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Boot image path or firmware configuration variable modified outside of maintenance windows"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Kernel-Boot",
                    "channel": "Firmware integrity validation failed or boot configuration tampered"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "write access to /dev/mem or /sys/firmware/efi/efivars"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "boot failure events or SMC validation errors"
                },
                {
                    "name": "networkdevice:firmware",
                    "channel": "Firmware update initiated or bootloader tampering detected"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Log entries indicating ROMMON image upgrade commands (boot system, upgrade rom-monitor)"
                },
                {
                    "name": "networkdevice:config",
                    "channel": "Boot variable modified to point to non-standard or unsigned image"
                },
                {
                    "name": "firmware:integrity ",
                    "channel": "Firmware integrity verification failures or mismatches against expected UEFI/firmware image baselines"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "ioctl/write: Direct firmware update or device memory manipulation syscalls"
                },
                {
                    "name": "firmware:smart",
                    "channel": "Unexpected firmware-level errors or abnormal S.M.A.R.T. log entries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Firmware update events or kernel extension (kext) loads not signed by Apple"
                },
                {
                    "name": "firmware:integrity",
                    "channel": "Baseline mismatch or unexpected EFI module detected during integrity checks"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Unexpected changes in EFI or NVRAM variables controlling hardware boot state"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Custom firmware or routing changes"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Storage",
                    "channel": "Raw disk I/O operations bypassing NTFS APIs"
                },
                {
                    "name": "firmware:runtime",
                    "channel": "Debug or memory access commands indicating attempts to alter OS instructions in memory"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Boot information log showing image loaded from TFTP server instead of local storage"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "post-update firmware hash does not match vendor-published checksum for the claimed version"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "reported firmware hash post-reboot not in authorized firmware inventory"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "device firmware hash does not match authorized firmware inventory following a reboot event"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "module-specific firmware hash post-write does not match authorized module firmware inventory"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory"
                },
                {
                    "name": "assetinventory:FirmwareHash",
                    "channel": "independently acquired firmware/module hash or vendor integrity measurement differs from approved baseline; protocol-response anomalies are corroboration only"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0016",
                    "external_id": "DC0016"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:48.544Z",
            "name": "Module Load",
            "description": "When a process or program dynamically attaches a shared library, module, or plugin into its memory space. This action is typically performed to extend the functionality of an application, access shared system resources, or interact with kernel-mode components.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.1",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "android:logcat",
                    "channel": "DexClassLoader/PathClassLoader load attempt from non-standard path or recently created file"
                },
                {
                    "name": "android:logcat",
                    "channel": "Short burst of file I/O followed by JNI/dlopen of a newly created .so"
                },
                {
                    "name": "android:logcat",
                    "channel": "DexClassLoader/PathClassLoader loading from app-writable path OR reflective defineClass on byte[] payload"
                },
                {
                    "name": "android:logcat",
                    "channel": "DexClassLoader|PathClassLoader load from app-writable path OR dlopen of a freshly created .so"
                },
                {
                    "name": "auditd:file-events",
                    "channel": "open of suspicious .so from non-standard paths"
                },
                {
                    "name": "auditd:MMAP",
                    "channel": "load: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "openat/read/mmap: Open/mmap .so files from non-standard paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "LD_PRELOAD Logging"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "mmap"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "dmesg"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "module load or memory map path"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "unexpected module load"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "module load"
                },
                {
                    "name": "ETW:LoadImage",
                    "channel": "provider: ETW LoadImage events for images from user-writable/UNC paths"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-ImageLoad",
                    "channel": "provider: Unsigned/user-writable image loads into msbuild.exe"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "dyld: dlopen/dyld_cache load from non-standard app-writable path"
                },
                {
                    "name": "iOS:unifiedlog",
                    "channel": "dlopen/image load from app-writable path (tmp, Caches) outside bundled resources"
                },
                {
                    "name": "linux:osquery",
                    "channel": "select: Open files path LIKE '/tmp/%.so' OR '/dev/shm/%.so'"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Dynamic Linking State"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Process linked with libcrypto.so making external connections"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Processes linked with libssl/libcrypto performing network activity"
                },
                {
                    "name": "linux:syslog",
                    "channel": "kmod"
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "EventCode=7"
                },
                {
                    "name": "m365:unified",
                    "channel": "Non-standard Office startup component detected (e.g., unexpected DLL path)"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_KEXTLOAD"
                },
                {
                    "name": "macos:osquery",
                    "channel": "select: path LIKE '%/Library/%/*.dylib' OR '/tmp/*.dylib'"
                },
                {
                    "name": "macos:syslog",
                    "channel": "DYLD_INSERT_LIBRARIES anomalies"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dyld/unified log entries indicating image load from non-system paths"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "dynamic loading of sleep-related functions or sandbox detection libraries"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "DYLD event subsystem"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process execution events with dylib load activity"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process memory maps new dylib (dylib_load event)"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Dylib loaded from abnormal location"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Loading of libz.dylib, libarchive.dylib by non-standard applications"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "suspicious dlopen/dlsym usage in non-development processes"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "delay/sleep library usage in user context"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.kextd"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "loading of unexpected dylibs compared to historical baselines"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "launch and dylib load"
                },
                {
                    "name": "Module",
                    "channel": "None"
                },
                {
                    "name": "snmp:status",
                    "channel": "Status change in cryptographic hardware modules (enabled -> disabled)"
                },
                {
                    "name": "WinEventLog:Application",
                    "channel": "CLR Assembly creation, loading, or modification logs via MSSQL CLR integration"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=3033"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=3063"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7; scripting-engine module loads when useful "
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7; System.Management.Automation or unusual PowerShell-related modules"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: DexClassLoader() or dlopen() called with path argument matching file written in preceding $DecryptExecWindow$"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: DexClassLoader() or dlopen() on path written within $StegoExecWindow$ of media download event — download-write-load chain confirms steganographic payload delivery"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: DexClassLoader() called at runtime with path NOT matching any file in original APK manifest within $PackerExecWindow$ of app launch"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: DexClassLoader() or System.load() or WebView.loadUrl(javascript:) called with content_source='network_download' within $CodeDownloadWindow$ of download event"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 of Industrial Control Systems (ICS) vendor communication Dynamic Link Library (DLL) with hash not in signed baseline"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 of GDI32.dll/User32.dll by process not in authorized screen capture tools on Human-Machine Interface (HMI)-classified host"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0063",
                    "external_id": "DC0063"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:52.610Z",
            "name": "Windows Registry Key Modification",
            "description": "Changes made to an existing registry key or its values. These modifications can include altering permissions, modifying stored data, or updating configuration settings.\n\n*Data Collection Measures:*\n\n- Windows Event Logs\n    - Event ID 4657 - Registry Value Modified: Logs changes to registry values, including modifications to startup entries, security settings, or system configurations.\n- Sysmon (System Monitor) for Windows\n    - Sysmon Event ID 13 - Registry Value Set: Captures changes to specific registry values.\n    - Sysmon Event ID 14 - Registry Key & Value Renamed: Logs renaming of registry keys, which may indicate evasion attempts.\n- Endpoint Detection and Response (EDR) Solutions\n    - Monitor registry modifications for suspicious behavior.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4657"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4663, 4670, 4656"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "StubPath value written under HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components"
                },
                {
                    "name": "m365:unified",
                    "channel": "MacroSecuritySettingsChanged or SafeModeDisabled"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=13, 14"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "modification to Winlogon registry keys such as Shell, Notify, or Userinit"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Registry key modification HKLM\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "g_CiOptions modification or SIP state change"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "Autoruns reports DLLs in AppInit_DLLs key"
                },
                {
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) server data change notification or value write from client_id not matching authorized data acquisition service"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=13 to Communication (COM) port configuration key by process not in authorized serial port management tools"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0040",
                    "external_id": "DC0040"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:44.580Z",
            "name": "File Deletion",
            "description": "Refers to events where files are removed from a system or storage device. These events can indicate legitimate housekeeping activities or malicious actions such as attackers attempting to cover their tracks. Monitoring file deletions helps organizations identify unauthorized or suspicious activities.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "File",
                    "channel": "None"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unlink/unlinkat on service binaries or data targets"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "file deletion"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "esxi:shell",
                    "channel": "shell history"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=23"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "PATH"
                },
                {
                    "name": "esxi:shell",
                    "channel": "/var/log/shell.log"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "delete action"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unlink, unlinkat, openat, write"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec rm -rf|dd if=/dev|srm|file unlink"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unlink, unlinkat, rmdir"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unlink, rename, open"
                },
                {
                    "name": "linux:Sysmon",
                    "channel": "EventCode=23"
                },
                {
                    "name": "fs:fsusage",
                    "channel": "unlink, fs_delete"
                },
                {
                    "name": "docker:daemon",
                    "channel": "container file operations"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "rm, clearlogs, logrotate"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "Datastore file operations"
                },
                {
                    "name": "macos:osquery",
                    "channel": "CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "unlink/unlinkat"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Backup",
                    "channel": "Windows Backup Catalog deletion or catalog corruption"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "/etc/fstab, /etc/systemd/*"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application deletes, alters, renames, relocates, or suppresses local artifacts relevant to detection, including files, hidden media, compromise markers, or app-local evidence, before later continued execution or transfer"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application deletes package files, cleanup artifacts, or app-local state immediately before disappearance from installed inventory or runtime"
                },
                {
                    "name": "MobileEDR:telemetry",
                    "channel": "application deletes, truncates, or removes user, operational, or evidence-bearing files after prior access or staging and before later continued execution or communication"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes, truncates, or removes files that were recently written by the same app (collected data, staged exfil artifacts, operation logs) within $PostExfilCleanupWindow$ of network upload event — post-exfil cleanup chain"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: unlink() or rmdir() on path IN /data/data/ OR /data/user/ OR /sdcard/ by process NOT IN $MDMAgentPackageList$ at rate > $DeletionRateThreshold$ within $DestructionWindow$"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs"
                },
                {
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=23 across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold within data destruction time window, by process not in authorized data management tools"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools"
                },
                {
                    "name": "WinEventLog:System",
                    "channel": "EventCode=104 outside scheduled log rotation window"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0034",
                    "external_id": "DC0034"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:44.003Z",
            "name": "Process Metadata",
            "description": "Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.2",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=400/403; engine lifecycle/context"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve call for sudo where euid != uid"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Use of fork/exec with DISPLAY unset or redirected"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve, prctl, or ptrace activity affecting process memory or command-line arguments"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve with UID ≠ EUID"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "execve with escalated privileges"
                },
                {
                    "name": "AWS:CloudTrail",
                    "channel": "cross-account or unexpected assume role"
                },
                {
                    "name": "containerd:events",
                    "channel": "Docker or containerd image pulls and process executions"
                },
                {
                    "name": "EDR:hunting",
                    "channel": "Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess*, LoadLibrary*)"
                },
                {
                    "name": "EDR:Telemetry",
                    "channel": "Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)"
                },
                {
                    "name": "esxi:auth",
                    "channel": "user session"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "/var/log/hostd.log API calls reading/altering time/ntp settings"
                },
                {
                    "name": "etw:Microsoft-Windows-ClickOnce",
                    "channel": "provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)"
                },
                {
                    "name": "etw:Microsoft-Windows-Kernel-Process",
                    "channel": "process_start: EventHeader.ProcessId true parent vs reported PPID mismatch"
                },
                {
                    "name": "linux:osquery",
                    "channel": "Cross-reference argv[0] with actual executable path and parent process metadata"
                },
                {
                    "name": "linux:osquery",
                    "channel": "select: path LIKE '/dev/video%'"
                },
                {
                    "name": "linux:osquery",
                    "channel": "state=attached/debugged"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process metadata mismatch between /proc and runtime attributes"
                },
                {
                    "name": "linux:osquery",
                    "channel": "process environment variables containing LD_PRELOAD"
                },
                {
                    "name": "linux:syslog",
                    "channel": "sudo or service accounts invoking loaders with suspicious env vars"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Kernel or daemon warnings of downgraded TLS or cryptographic settings"
                },
                {
                    "name": "macos:endpointsecurity",
                    "channel": "ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Process Context"
                },
                {
                    "name": "macos:osquery",
                    "channel": "Process Execution + Hash"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "subsystem=com.apple.TCC"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "exec of binary with setuid/setgid and EUID != UID"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Code Execution & Entitlement Access"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "code signature/memory protection"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "log collect from launchd and process start"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Modifications or writes to EFI system partition for downgraded bootloaders"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "non-shell process tree accessing bash history"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "Crash or abnormal termination of security agent or system extension host"
                },
                {
                    "name": "networkdevice:syslog",
                    "channel": "Admin activity"
                },
                {
                    "name": "Process",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:AppLocker",
                    "channel": "AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "Unsigned/invalid signature modules or images loaded by msbuild.exe or its children"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational",
                    "channel": "Unsigned or untrusted modules loaded during JamPlus.exe runtime"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-DeviceGuard/Operational",
                    "channel": "WDAC policy audit/block affecting msbuild.exe spawned payloads"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode",
                    "channel": "ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-SmartAppControl/Operational",
                    "channel": "Smart App Control decisions (audit/block) for msbuild.exe-launched executables"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational",
                    "channel": "Process session start/stop events for camera pipeline by unexpected executables"
                },
                {
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=400, 403"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: running process names read from /proc/<PID>/status or /proc/<PID>/cmdline by app NOT IN $ProcessDiscoveryAllowList$"
                },
                {
                    "name": "mobile:DynamicAnalysis",
                    "channel": "Dynamic API/runtime trace: process executing with effective UID=0"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with env containing LD_PRELOAD where exe matches Industrial Control Systems (ICS) service binary list and preload library not in vendor package manifest"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo"
                },
                {
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs"
                },
                {
                    "name": "edr:ProcessIntegrity",
                    "channel": "Process integrity/hash mismatch detected on Industrial Control Systems (ICS) communication process post-hook-install event"
                },
                {
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0001",
                    "external_id": "DC0001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:53.278Z",
            "name": "Scheduled Job Creation",
            "description": "The establishment of a task or job that will execute at a predefined time or based on specific triggers.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack",
                "mobile-attack"
            ],
            "x_mitre_version": "3.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Scheduled Job",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4698"
                },
                {
                    "name": "linux:syslog",
                    "channel": "Execution of non-standard script or binary by cron"
                },
                {
                    "name": "WinEventLog:TaskScheduler",
                    "channel": "EventCode=106"
                },
                {
                    "name": "linux:osquery",
                    "channel": "crontab, systemd_timers"
                },
                {
                    "name": "macos:osquery",
                    "channel": "launchd_jobs"
                },
                {
                    "name": "esxi:vmkernel",
                    "channel": "Startup script and task execution logs"
                },
                {
                    "name": "kubernetes:apiserver",
                    "channel": "verb=create, resource=cronjobs, group=batch"
                },
                {
                    "name": "linux:osquery",
                    "channel": "file_events"
                },
                {
                    "name": "macos:unifiedlog",
                    "channel": "process: crontab edits, launch of cron job"
                },
                {
                    "name": "macos:osquery",
                    "channel": "file_events - cron, launchd"
                },
                {
                    "name": "esxi:cron",
                    "channel": "execution of scheduled job"
                },
                {
                    "name": "esxi:hostd",
                    "channel": "task creation events"
                },
                {
                    "name": "macos:cron",
                    "channel": "cron/launchd"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4699"
                },
                {
                    "name": "linux:cron",
                    "channel": "Scheduled execution of unknown or unusual script/binary"
                },
                {
                    "name": "MobiledEDR:telemetry",
                    "channel": "Scheduled task execution creates cache, staged payload, local output, or collected data artifact immediately after wake or job trigger"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution creates file, accesses sensor, or initiates network connection immediately after firing, with no recent user interaction triggering the task"
                },
                {
                    "name": "mobile:ForensicArtifacts",
                    "channel": "Dynamic filesystem trace or acquired app-container/filesystem artifacts: Scheduled task execution produces network, local-write, or sensor artifact while app_state=background or device_locked=true without user trigger"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa",
            "created": "2021-10-20T15:05:19.275Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0102",
                    "external_id": "DC0102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:49.731Z",
            "name": "Network Share Access",
            "description": "Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Network Share",
                    "channel": "None"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-SMBClient/Security",
                    "channel": "EventCode=31001"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=5140"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=5145"
                },
                {
                    "name": "WinEventLog:Microsoft-Windows-SMBServer",
                    "channel": "Access to SYSVOL share from non-admin user or unusual endpoints"
                },
                {
                    "name": "NSM:Flow",
                    "channel": "smb_files.log"
                },
                {
                    "name": "m365:unified",
                    "channel": "FileUploaded, FileAccessed"
                },
                {
                    "name": "fileserver:audit",
                    "channel": "sequential access to above bulk document access threshold files within information repository time window from single session"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources"
                }
            ]
        },
        {
            "type": "x-mitre-data-component",
            "spec_version": "2.1",
            "id": "x-mitre-data-component--faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datacomponents/DC0012",
                    "external_id": "DC0012"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:14:38.292Z",
            "name": "Scheduled Job Modification",
            "description": "Changes made to an existing scheduled job, including modifications to its execution parameters, command payload, or execution timing.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "2.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_log_sources": [
                {
                    "name": "Scheduled Job",
                    "channel": "None"
                },
                {
                    "name": "auditd:CONFIG_CHANGE",
                    "channel": "/var/log/audit/audit.log"
                },
                {
                    "name": "m365:exchange",
                    "channel": "Remove-InboxRule, Clear-Mailbox"
                },
                {
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4702"
                }
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0002",
                    "external_id": "DS0002"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "User Account",
            "description": "A profile representing a user, device, service, or application used to authenticate and access resources",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Containers",
                "IaaS",
                "Linux",
                "SaaS",
                "Windows",
                "macOS",
                "Office Suite",
                "Identity Provider",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Cloud Control Plane",
                "Container",
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0024",
                    "external_id": "DS0024"
                },
                {
                    "source_name": "Microsoft Registry",
                    "description": "Microsoft. (2018, May 31). Registry. Retrieved September 29, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Windows Registry",
            "description": "A Windows OS hierarchical database that stores much of the information and settings for software programs, hardware devices, user preferences, and operating-system configurations(Citation: Microsoft Registry)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--12c1e727-7fa4-49b6-af81-366ed2ce231e",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0012",
                    "external_id": "DS0012"
                },
                {
                    "source_name": "FireEye PowerShell Logging",
                    "description": "Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021.",
                    "url": "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html"
                },
                {
                    "source_name": "Microsoft AMSI",
                    "description": "Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal"
                },
                {
                    "source_name": "Microsoft PowerShell Logging",
                    "description": "Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Script",
            "description": "A file or stream containing a list of commands, allowing them to be launched in sequence(Citation: Microsoft PowerShell Logging)(Citation: FireEye PowerShell Logging)(Citation: Microsoft AMSI)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Windows",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552",
            "created": "2022-05-11T16:22:58.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0040",
                    "external_id": "DS0040"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Operational Databases",
            "description": "Operational databases contain information about the status of the operational process and associated devices, including any measurements, events, history, or alarms that have occurred",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--40269753-26bd-437b-986e-159c66dec5e4",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0015",
                    "external_id": "DS0015"
                },
                {
                    "source_name": "Confluence Logs",
                    "description": "Confluence Support. (2021, April 22). Working with Confluence Logs. Retrieved September 23, 2021.",
                    "url": "https://confluence.atlassian.com/doc/working-with-confluence-logs-108364721.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Application Log",
            "description": "Events collected by third-party services such as mail servers, web applications, or other appliances (not by the native OS or platform)(Citation: Confluence Logs)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "IaaS",
                "Linux",
                "SaaS",
                "Windows",
                "macOS",
                "Office Suite",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_collection_layers": [
                "Cloud Control Plane",
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0028",
                    "external_id": "DS0028"
                },
                {
                    "source_name": "Microsoft Audit Logon Events",
                    "description": "Microsoft. (2021, September 6). Audit logon events. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Logon Session",
            "description": "Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "IaaS",
                "Linux",
                "SaaS",
                "Windows",
                "macOS",
                "Office Suite",
                "Identity Provider",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Cloud Control Plane",
                "Host",
                "Network"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0022",
                    "external_id": "DS0022"
                },
                {
                    "source_name": "Microsoft File Mgmt",
                    "description": "Microsoft. (2018, May 31). File Management (Local File Systems). Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/fileio/file-management"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "File",
            "description": "A computer resource object, managed by the I/O system, for storing data (such as images, text, videos, computer programs, or any wide variety of other media).(Citation: Microsoft File Mgmt)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Network Devices",
                "Windows",
                "macOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0016",
                    "external_id": "DS0016"
                },
                {
                    "source_name": "Sysmon EID 9",
                    "description": "Russinovich, R. & Garnier, T. (2021, August 18). Sysmon Event ID 9. Retrieved September 24, 2021.",
                    "url": "https://docs.microsoft.com/sysinternals/downloads/sysmon#event-id-9-rawaccessread"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Drive",
            "description": "A non-volatile data storage device (hard drive, floppy disk, USB flash drive) with at least one formatted partition, typically mounted to the file system and/or assigned a drive letter(Citation: Sysmon EID 9)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0017",
                    "external_id": "DS0017"
                },
                {
                    "source_name": "Confluence Linux Command  Line",
                    "description": "Confluence Support. (2021, September 8). How to enable command line audit logging in linux. Retrieved September 23, 2021.",
                    "url": "https://confluence.atlassian.com/confkb/how-to-enable-command-line-audit-logging-in-linux-956166545.html"
                },
                {
                    "source_name": "Audit OSX",
                    "description": "Gagliardi, R. (n.d.). Audit in a OS X System. Retrieved September 23, 2021.",
                    "url": "https://www.scip.ch/en/?labs.20150108"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Command",
            "description": "A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task(Citation: Confluence Linux Command  Line)(Citation: Audit OSX)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Containers",
                "Linux",
                "Network Devices",
                "Windows",
                "macOS",
                "Android",
                "iOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)",
                "Austin Clark, @c2defense"
            ],
            "x_mitre_collection_layers": [
                "Container",
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--b1717cb4-d536-4e2b-b5e5-07e67e26183c",
            "created": "2022-05-11T16:22:58.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0039",
                    "external_id": "DS0039"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Asset",
            "description": "Data sources with information about the set of devices found within the network, along with their current software and configurations",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--ba27545a-9c32-47ea-ba6a-cce50f1b326e",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0033",
                    "external_id": "DS0033"
                },
                {
                    "source_name": "Microsoft NFS Overview",
                    "description": "Microsoft. (2018, July 9). Network File System overview. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows-server/storage/nfs/nfs-overview"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Network Share",
            "description": "A storage resource (typically a folder or drive) made available from one host to others using network protocols, such as Server Message Block (SMB) or Network File System (NFS)(Citation: Microsoft NFS Overview)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3",
            "created": "2021-10-20T15:05:19.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0029",
                    "external_id": "DS0029"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Network Traffic",
            "description": "Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "IaaS",
                "Linux",
                "Windows",
                "macOS",
                "Android",
                "iOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)",
                "ExtraHop"
            ],
            "x_mitre_collection_layers": [
                "Cloud Control Plane",
                "Host",
                "Network"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883",
            "created": "2021-10-20T15:05:19.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0003",
                    "external_id": "DS0003"
                },
                {
                    "source_name": "Microsoft Tasks",
                    "description": "Microsoft. (2018, May 31). Tasks. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/taskschd/tasks"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Scheduled Job",
            "description": "Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)(Citation: Microsoft Tasks)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Containers",
                "Linux",
                "Windows",
                "macOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Container",
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--ca1cb239-ff6d-4f64-b9d7-41c8556a8b4f",
            "created": "2021-10-20T15:05:19.265Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0001",
                    "external_id": "DS0001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Firmware",
            "description": "Computer software that provides low-level control for the hardware and device(s) of a host, such as BIOS or UEFI/EFI",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb",
            "created": "2021-10-20T15:05:19.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0019",
                    "external_id": "DS0019"
                },
                {
                    "source_name": "Microsoft Services",
                    "description": "Microsoft. (2017, March 30). Introduction to Windows Service Applications. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/dotnet/framework/windows-services/introduction-to-windows-service-applications"
                },
                {
                    "source_name": "Linux Services Run Levels",
                    "description": "The Linux Foundation. (2006, January 11). An introduction to services, runlevels, and rc.d scripts. Retrieved September 28, 2021.",
                    "url": "https://www.linux.com/news/introduction-services-runlevels-and-rcd-scripts/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Service",
            "description": "A computer process that is configured to execute continuously in the background and perform system tasks, in some cases before any user has logged in(Citation: Microsoft Services)(Citation: Linux Services Run Levels)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.1",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0009",
                    "external_id": "DS0009"
                },
                {
                    "source_name": "Microsoft Processes and Threads",
                    "description": "Microsoft. (2018, May 31). Processes and Threads. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/procthread/processes-and-threads"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Process",
            "description": "Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures(Citation: Microsoft Processes and Threads)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS",
                "Android",
                "iOS",
                "ESXi"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "mobile-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.2",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-data-source",
            "spec_version": "2.1",
            "id": "x-mitre-data-source--f424e4b4-a8a4-4c58-a4ae-4f53bfd08563",
            "created": "2021-10-20T15:05:19.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/datasources/DS0011",
                    "external_id": "DS0011"
                },
                {
                    "source_name": "Microsoft LoadLibrary",
                    "description": "Microsoft. (2018, December 5). LoadLibraryA function (libloaderapi.h). Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya"
                },
                {
                    "source_name": "Microsoft Module Class",
                    "description": "Microsoft. (n.d.). Module Class. Retrieved September 28, 2021.",
                    "url": "https://docs.microsoft.com/en-us/dotnet/api/system.reflection.module"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "name": "Module",
            "description": "Executable files consisting of one or more shared classes and interfaces, such as portable executable (PE) format binaries/dynamic link libraries (DLL), executable and linkable format (ELF) binaries/shared libraries, and Mach-O format binaries/shared libraries(Citation: Microsoft LoadLibrary)(Citation: Microsoft Module Class)",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_platforms": [
                "Linux",
                "Windows",
                "macOS"
            ],
            "x_mitre_deprecated": true,
            "x_mitre_domains": [
                "ics-attack",
                "enterprise-attack"
            ],
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.2.0",
            "x_mitre_contributors": [
                "Center for Threat-Informed Defense (CTID)"
            ],
            "x_mitre_collection_layers": [
                "Host"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--04bcf663-e6cd-42bf-8864-f4d1ad345263",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0780",
                    "external_id": "DET0780"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:50.204Z",
            "name": "Detection of Rootkit",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--ec695157-8c3c-439b-9925-459c9d4172f0",
                "x-mitre-analytic--a2ab9718-e601-4c5d-94ad-6382df57987c",
                "x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119",
                "x-mitre-analytic--f45c158a-7086-4172-9fe4-1684e0ca34ee"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--05f7d4e4-ae99-4339-b71a-59f1e317dc6d",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0789",
                    "external_id": "DET0789"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:31.175Z",
            "name": "Detection of Block Reporting Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--393d7e7b-0790-49e7-9bcd-87ab4662b05e",
                "x-mitre-analytic--d2a6ecfe-089b-47cc-8f10-260ad2de9c2e",
                "x-mitre-analytic--d585c9c1-aa82-4b3c-a42d-eb499d996219",
                "x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--06443942-ba28-4d13-b4b4-93317d6eafa5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0725",
                    "external_id": "DET0725"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:06.182Z",
            "name": "Detection of Masquerading",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--791310ad-7db5-41df-9fa5-fa4097d8a51d",
                "x-mitre-analytic--b011484e-65d1-408a-b361-67d945e9ca87",
                "x-mitre-analytic--684fc82e-39d7-48c8-9123-5badd99afaa7",
                "x-mitre-analytic--856d21f6-edc1-4e7b-84c5-692a467a2dbe"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--08c090e3-c56f-4a8b-80f6-307a1daf46ea",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0723",
                    "external_id": "DET0723"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:37.024Z",
            "name": "Detection of Denial of Service",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--cff25f71-859e-48bf-88d6-852d05e22b33",
                "x-mitre-analytic--2c7a6c0b-55f7-44d1-a605-bf2dd1dee01a",
                "x-mitre-analytic--197be8a2-8569-4304-9fe8-b987c8ed79b1",
                "x-mitre-analytic--8e055360-9991-43ef-bd20-2b3f40432c78"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--09754c36-7be2-4536-aad2-a6c3568ba0e5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0766",
                    "external_id": "DET0766"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:16.359Z",
            "name": "Detection of Project File Infection",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--6e046c4c-6c93-4fdf-a69e-5d81b52d1e9c",
                "x-mitre-analytic--aef5883b-f520-4309-aacc-d233b31ec860"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--09f46edf-33f9-4c23-af2f-74864c27f616",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0731",
                    "external_id": "DET0731"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:19.620Z",
            "name": "Detection of System Firmware",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--3f10ffe9-fa73-4aeb-bf98-322831bf757f",
                "x-mitre-analytic--1f5ec3e0-2b7d-4b6d-992b-c5849911df1e",
                "x-mitre-analytic--6829c203-6543-4489-bab8-422a41ac82a1",
                "x-mitre-analytic--c5274e54-6a55-4aae-b438-aed5c1ef8acd"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--0f2e4927-401d-430e-96ed-90feb8df1b03",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0738",
                    "external_id": "DET0738"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:25.144Z",
            "name": "Detection of Exploitation for Privilege Escalation",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--b6fb91d0-28f6-447d-ba25-e7b26116ebfe",
                "x-mitre-analytic--efad38ee-8529-4860-9d22-d5a36626cb2d",
                "x-mitre-analytic--ee51b3ed-fb50-46dc-b21f-d28a98467941",
                "x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--105c127f-2777-452e-bf61-b0786ee13861",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0728",
                    "external_id": "DET0728"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:54.503Z",
            "name": "Detection of Alarm Suppression",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--edd8297d-ec63-4b54-8d28-106f228dd535",
                "x-mitre-analytic--a7766ca3-ff83-48fe-b6aa-5a781c64d95b",
                "x-mitre-analytic--62dee878-27af-4620-b710-10b0ca373701",
                "x-mitre-analytic--d3adcced-e0c1-4b3c-8a54-f0edd3805df0"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--13412b71-b94e-4aef-912a-44853f8bff05",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0769",
                    "external_id": "DET0769"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.669Z",
            "name": "Detection of Denial of View",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--68073351-4e4f-40e4-9394-a9166bb346d7"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--194cb4dd-81ca-4e64-94e2-911fab1219f9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0801",
                    "external_id": "DET0801"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:20.456Z",
            "name": "Detection of Device Restart/Shutdown",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--fcfe9c48-3a5a-49c8-96c3-be79414a8419",
                "x-mitre-analytic--5db2235a-aa06-47b7-a89e-953a5afb6555",
                "x-mitre-analytic--17713d7e-3d88-47b0-b5b0-fd60cd90bf86",
                "x-mitre-analytic--b15aa5f3-acb3-4de6-831b-3f2a259baf63"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--1bae319f-03d8-49c9-8bb8-e4f27bb69a11",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0786",
                    "external_id": "DET0786"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.671Z",
            "name": "Detection of Denial of Control",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--7ec4b791-7054-442f-8967-6d6fa5e8678b"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--2145faf1-28da-4ebc-9730-f2e2a8764ced",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0732",
                    "external_id": "DET0732"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.672Z",
            "name": "Detection of Theft of Operational Information",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--cd4c92f9-3107-45c7-9d95-19a44d7dc92c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--2a1619a7-dd27-48e4-b56f-806cb3d2e405",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0784",
                    "external_id": "DET0784"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:30.286Z",
            "name": "Detection of Block Command Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--11a350cf-1ea0-4065-877b-c3bb410bf3a0",
                "x-mitre-analytic--b4eeeacf-6d03-4350-ae75-b87e28b697bc",
                "x-mitre-analytic--a318c729-65ad-424b-a67b-c6b38fb0a708"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--2e99cd65-aad4-4796-9013-79837d498eb6",
            "created": "2026-04-23T00:09:43.016Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0913",
                    "external_id": "DET0913"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:54.007Z",
            "name": "Detection of Program Download All",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--e379be82-39d7-4ae4-8557-f846ba19cd4b"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--31773402-e407-4ed3-b86c-7a8587dc5ec9",
            "created": "2026-04-22T17:55:10.734Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0906",
                    "external_id": "DET0906"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:22.714Z",
            "name": "Detection of Siemens Project File Format Infection",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--6a510bf0-0289-4eb0-8645-89f0f4d32cf3",
                "x-mitre-analytic--c5204537-15c5-42ff-baee-f7d029157ca9"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--336b9423-5543-4354-bd00-13c614ccdc96",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0771",
                    "external_id": "DET0771"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:28.708Z",
            "name": "Detection of Change Credential",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--d3023733-5874-4746-a947-65925514e382",
                "x-mitre-analytic--3fdeb2a5-e60c-4fac-b003-528676da2f05",
                "x-mitre-analytic--2862e391-b78a-400f-819e-d44e672e3d3a",
                "x-mitre-analytic--6c7a03f0-1697-4109-9b8c-70567ed5eaf4"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--33dd1c37-1702-4de2-9712-fcc640e4b681",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0736",
                    "external_id": "DET0736"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:40.302Z",
            "name": "Detection of Commonly Used Port",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--981b659b-992a-4d71-9404-0e1b2b598e50",
                "x-mitre-analytic--8aac97f9-602a-440f-b846-7a11e6a157ca",
                "x-mitre-analytic--5330f4ab-a6f0-411d-957d-bb7bd2a73ddf",
                "x-mitre-analytic--23d4c3a3-a195-4d5f-a5c5-ae4d23054ee4"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--37b4971d-2eb8-4f87-899c-19acaf0394bb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0778",
                    "external_id": "DET0778"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.674Z",
            "name": "Detection of Loss of Control",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--cbf791b4-5186-4205-ac5a-a56042aaebec"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--3a772c6d-fda2-404a-86aa-85a0bdbb43e9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0749",
                    "external_id": "DET0749"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:01.722Z",
            "name": "Detection of Data from Local System",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--0099659c-6a20-4331-9d47-b1c0c380fd6b",
                "x-mitre-analytic--346fbf4f-5fc5-4acb-9d2f-cd30c3c22226",
                "x-mitre-analytic--b41c2b27-08ce-4f3c-a810-484f100422a3",
                "x-mitre-analytic--2d784f76-a3e0-46ed-8ce2-d9dcd531fa52"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--3e884c49-75ca-449e-83cb-3517ee88e0f1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0751",
                    "external_id": "DET0751"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:44.722Z",
            "name": "Detection of Screen Capture",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--66070162-d51e-46e7-8d32-2140fd5e7086",
                "x-mitre-analytic--04d594f0-5158-4965-a81d-f757f841bbe1",
                "x-mitre-analytic--c2027adc-ff27-4bdc-a9bd-2e96b4aacc15"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--3ea60ac7-87a3-4033-9089-258941d8388a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0737",
                    "external_id": "DET0737"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:13.703Z",
            "name": "Detection of Brute Force I/O",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--77857bc3-6a38-4826-8109-30facf6c23ec",
                "x-mitre-analytic--4be2c353-ef8d-4bb4-b973-4cae602f627f",
                "x-mitre-analytic--49d64aa5-8804-45c9-99d9-b0729f3dc58c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--441ded70-7e25-47f1-b55c-0fafb7d4f44c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0770",
                    "external_id": "DET0770"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:48.197Z",
            "name": "Detection of Network Connection Enumeration",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--7aa60595-5a1c-4de2-be60-cc1f9fea2313",
                "x-mitre-analytic--35c7f7bd-a79b-4125-ba0c-2bbf281ebf51",
                "x-mitre-analytic--8d30e2a3-b7a5-403b-ad5f-243f37f44fa4",
                "x-mitre-analytic--4effd386-490e-435b-9375-f53a3b44f0d0"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--442bf059-f7cf-460b-8200-f35e1e0a0c78",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0734",
                    "external_id": "DET0734"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:39.480Z",
            "name": "Detection of Automated Collection",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--e25ef816-bbfd-4656-8ecb-c7eebcba31d4",
                "x-mitre-analytic--e25f2fd3-1172-447f-8c03-715689666691",
                "x-mitre-analytic--7d922eff-22d6-4ac2-90d9-3539e0c998fe"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--442e5dcf-7f41-4ba5-ba89-aefb0d1c63cf",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0776",
                    "external_id": "DET0776"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:16.865Z",
            "name": "Detection of Modify Parameter",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--48d2023b-469d-4f9f-a4e6-010be72436b9",
                "x-mitre-analytic--13b48db7-e4d4-47a3-8bd1-60f9c2a039da",
                "x-mitre-analytic--74cb9e26-6ec1-41e8-9da8-ed30504f9c39"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--47c6f72c-1f2f-4ea8-94d0-08202b7d5bdb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0785",
                    "external_id": "DET0785"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.676Z",
            "name": "Detection of Manipulation of View",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--d71e98fa-64d1-4ddb-acb1-bba1e4af6a73"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--4ea060f9-f6fc-4122-9544-70afd567ea10",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0797",
                    "external_id": "DET0797"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:55.820Z",
            "name": "Detection of Block Serial COM",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--354b93da-06e9-4634-a5fd-7f9b7b3a9d5a",
                "x-mitre-analytic--792af2a0-7fc2-4b63-899e-ae09dea3aef1",
                "x-mitre-analytic--2a89e23c-fb19-456c-bf77-db29bc673301",
                "x-mitre-analytic--51c17c6d-d4f7-46f6-840e-3697b33d2783"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--519082ce-24ab-4f6b-9e86-b9443758c9d4",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0793",
                    "external_id": "DET0793"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:58.830Z",
            "name": "Detection of System Binary Proxy Execution",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--23ce0ac3-6afe-4647-be72-e1e9bcd1490e",
                "x-mitre-analytic--18409dae-85cb-4460-a2a6-f287991f0dca",
                "x-mitre-analytic--22252671-e8e9-4853-8696-7a38ec7bad53"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--527668a3-cc0c-48c2-856a-a45615817366",
            "created": "2026-04-22T22:56:48.997Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0912",
                    "external_id": "DET0912"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:12.091Z",
            "name": "Detection of Block Wi-Fi",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--0b4e7cfa-9f9d-49b0-b5bf-afdf62058c5a",
                "x-mitre-analytic--7e96cc61-f4ca-4546-8631-3ef6fff8ae28",
                "x-mitre-analytic--49d68949-cdc8-4364-9700-7786f4d08871",
                "x-mitre-analytic--74ac7748-3b80-4aac-ad25-c3e6914cb01a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--5604323b-6e7a-4801-91ae-4bf591f2e3ac",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0788",
                    "external_id": "DET0788"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:18.578Z",
            "name": "Detection of Point & Tag Identification",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--484023ea-6fea-4f91-b40d-c6d87188cbfe",
                "x-mitre-analytic--8713afc6-95d2-4064-a047-a9be0cc486dd",
                "x-mitre-analytic--d5cdbfae-d4c3-4379-9330-de223f74fb09",
                "x-mitre-analytic--ac890be9-5686-42bf-9a1c-ac7fd8bb283a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--56bf71a3-a28b-4a8f-84ed-3a71449d47c0",
            "created": "2026-04-22T20:46:31.212Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0909",
                    "external_id": "DET0909"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:02.875Z",
            "name": "Detection of Multicast Discovery",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--67861309-0ba7-4713-843e-3def87e396ec",
                "x-mitre-analytic--7ddbb1f7-feda-4a50-b944-b02bedf653b5",
                "x-mitre-analytic--5f4e48bc-ac0a-4a86-8d59-229105b212ca",
                "x-mitre-analytic--3a8c6bca-bc2c-4a70-9446-8b2adca39441"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--58b4bda4-d69a-4a20-ab67-308c4451a5e8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0730",
                    "external_id": "DET0730"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:55.528Z",
            "name": "Detection of Supply Chain Compromise",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--899d0dce-64f7-4924-93a1-8e3c83dd510f",
                "x-mitre-analytic--c5bd7cb8-0223-4cc6-a390-80178e24e48d",
                "x-mitre-analytic--9508cebc-ee97-47e6-b603-5fdf88f9f54f",
                "x-mitre-analytic--c4d5acb4-61c8-4142-bf26-5865d235f02f"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--5ba60cf7-738d-4ed4-827c-8c763ad9f0f0",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0753",
                    "external_id": "DET0753"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:03.413Z",
            "name": "Detection of Native API",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--aebd2848-98db-46f1-8e22-627e2ec3c280",
                "x-mitre-analytic--b4b66413-59b9-45bb-93d4-a0a99da9e9a4",
                "x-mitre-analytic--c41ec8c0-34b0-4573-8643-7366cfbbe4ac",
                "x-mitre-analytic--66c22dd3-7665-4ead-ab01-5a4742c37d8b"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--60a55b7b-29a5-437e-83a7-edbe6f3c4415",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0727",
                    "external_id": "DET0727"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:12.884Z",
            "name": "Detection of Monitor Process State",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--1be515a0-2656-4b35-a561-e8157169350d",
                "x-mitre-analytic--0aa3c64b-e708-4fe2-9764-af61670e1172",
                "x-mitre-analytic--a0774b4b-493d-4025-bf19-b94280371478",
                "x-mitre-analytic--c0e95b25-fa40-4794-a262-498aff3b9fd1"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--62587e44-0623-4b14-bd45-126430eaed4a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0745",
                    "external_id": "DET0745"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:45.686Z",
            "name": "Detection of Lateral Tool Transfer",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--930aae7c-e8f0-4594-8e3f-f0e71d7e1640",
                "x-mitre-analytic--af14d56d-c96c-4ab4-8377-a3ecfba26962",
                "x-mitre-analytic--a0c69c57-549d-4cdd-82eb-0654d8df364e"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--636329e6-32b9-4a71-acf8-ae6d01a6b4ef",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0787",
                    "external_id": "DET0787"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:07.632Z",
            "name": "Detection of Remote System Information Discovery",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--f123f13f-b6f4-4e86-96cd-14df0e855e0f",
                "x-mitre-analytic--35b0fba9-70c7-420b-a9eb-b3caf6b9d87e",
                "x-mitre-analytic--736619f9-f636-4308-843b-83d38813982b",
                "x-mitre-analytic--4062a3b7-6859-4b28-b0d3-b0f71dc62f6a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--67c2be08-d31a-4385-a637-9d1a907c7a26",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0767",
                    "external_id": "DET0767"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:07.349Z",
            "name": "Detection of Exploitation of Remote Services",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--3e456d4d-397d-4e04-9261-9399960c9633",
                "x-mitre-analytic--c6552643-bbf2-4686-b050-af6f652fca79",
                "x-mitre-analytic--b89b2084-97e0-47cc-a9fd-bea4d0423b06",
                "x-mitre-analytic--f4abf9a4-ce83-41cf-85e2-a823d46ebf10"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--6bdde391-76eb-4bd7-9e19-e805ab98b7ac",
            "created": "2026-04-22T18:52:19.941Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0907",
                    "external_id": "DET0907"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:42.791Z",
            "name": "Detection of Port Scan",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--51a094bf-b7eb-452a-9b7a-ffac16fce1ac",
                "x-mitre-analytic--b03ff220-3bf8-41bd-a443-0ae287fa8e74",
                "x-mitre-analytic--ff0f3e46-3817-4b77-a188-74720d721c03",
                "x-mitre-analytic--bed265af-6f51-42c1-b4d2-691535a32d67"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--6d2ba563-0aa9-4f64-a14d-da62b694b495",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0802",
                    "external_id": "DET0802"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:58.355Z",
            "name": "Detection of Activate Firmware Update Mode",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--96e7b86f-b960-489c-882b-9dcdb1c44aa9",
                "x-mitre-analytic--46022e9c-fcb9-4369-b953-ad5724a6819b",
                "x-mitre-analytic--39fb5809-408b-4f42-a26f-92d372d1a041",
                "x-mitre-analytic--76f95bb8-16c3-42f7-99a0-929e6f08a24e"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--6f318bab-df4a-4a51-b849-e9c2ab2f9c4c",
            "created": "2026-04-22T15:09:30.933Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0903",
                    "external_id": "DET0903"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:34.378Z",
            "name": "Detection of Block Operational Technology Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--c556c91d-64a0-401c-9c41-18971eeca0f2",
                "x-mitre-analytic--da7a9116-f290-4160-a24a-930d8961ddf4",
                "x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--6f921aa8-deb3-4286-8101-26a7cbe80c0e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0761",
                    "external_id": "DET0761"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.681Z",
            "name": "Detection of Program Upload",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--3c6a21cb-8643-41bc-94a1-e860b02a1cad"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--709e05b2-6400-43a2-9bbf-b64f6017b023",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0752",
                    "external_id": "DET0752"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.681Z",
            "name": "Detection of Program Download",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--b74100d1-0085-468a-834a-2bf10924a3b7"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--732d2487-3241-4866-8bb5-044bb4acdd3b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0799",
                    "external_id": "DET0799"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:56.723Z",
            "name": "Detection of Standard Application Layer Protocol",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--d271c7fc-d76a-4fb0-a645-5db2c1223a32",
                "x-mitre-analytic--62facfaa-0d19-4479-8cd7-cfef4c30898c",
                "x-mitre-analytic--f95ebff8-48ae-409a-adfb-8230d870768b",
                "x-mitre-analytic--154de82d-e589-4dab-ae2a-42a61dc1443a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--73773bb8-c63b-4d48-9b48-33440f12a514",
            "created": "2026-04-22T15:56:01.514Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0904",
                    "external_id": "DET0904"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:55.817Z",
            "name": "Detection of Firmware Modification",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--fc6641ac-5748-4498-89e9-d4ada2b6f88a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--74b96bd4-dab9-494e-a540-b7c998581fd5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0804",
                    "external_id": "DET0804"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:41.956Z",
            "name": "Detection of Remote Services",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--058d856a-6356-402f-b3ff-a7c1b6186921",
                "x-mitre-analytic--060b84bc-0f25-4643-aa26-f98f32e6a860",
                "x-mitre-analytic--301b9d5c-6bcd-4539-9ace-6ae4c5d94c43",
                "x-mitre-analytic--6623745b-ae70-491c-a317-8206b4789463"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--7f32731d-7800-483c-b077-c4a187a27ae5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0726",
                    "external_id": "DET0726"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:37.856Z",
            "name": "Detection of Wireless Compromise",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--2388dc31-ba9a-4c12-b4b9-28bbc981c73e",
                "x-mitre-analytic--47aafd6b-75d1-44e9-b2bc-505d9fbb4671",
                "x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--7f41ed29-fdc6-4c28-ba10-9de1aa129f7e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0783",
                    "external_id": "DET0783"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.682Z",
            "name": "Detection of Modify Program",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--882f2365-4c14-4c48-8eef-2a7c293c8569"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--825106d1-6f44-47a1-b8dd-c3e3b6cecab7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0777",
                    "external_id": "DET0777"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:49.663Z",
            "name": "Detection of Modify Alarm Settings",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--330166da-bc80-4aca-bd41-cbd6b1742812",
                "x-mitre-analytic--9e2addaf-2773-4bd1-8192-231451038024",
                "x-mitre-analytic--984bc0c8-77ee-4971-ba17-6a89fc401315",
                "x-mitre-analytic--bd1cb276-2ab0-4a91-8099-5c8a957e4968"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--87493fa2-bb78-4e28-b882-d79eecd10740",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0772",
                    "external_id": "DET0772"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:11.255Z",
            "name": "Detection of Graphical User Interface",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--dc014060-5116-4a2f-bac5-35ac1db8fabb",
                "x-mitre-analytic--a4594062-42a7-448f-99fb-5e4b2c005410",
                "x-mitre-analytic--d27cebed-41c5-46b8-8c98-a57d6c40805e",
                "x-mitre-analytic--21e2074e-f7d9-4a41-87e6-d365ac99a972"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--887ae691-a519-4b68-af26-bcea1483cef7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0759",
                    "external_id": "DET0759"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:45.587Z",
            "name": "Detection of Connection Proxy",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--ece52da2-ac60-4b0e-863f-ebbc95118a8c",
                "x-mitre-analytic--073153c5-a2dc-4985-b5f0-b0ee35f5457c",
                "x-mitre-analytic--4a1b6793-4389-40f7-a7d3-8ad98cba738e",
                "x-mitre-analytic--4984e65d-1bb6-4de1-8dfc-5672e822bb47"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--89e95503-b02c-43da-90b3-15584b27e6d6",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0782",
                    "external_id": "DET0782"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:57.972Z",
            "name": "Detection of Drive-by Compromise",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--32db74f9-d46d-4728-891a-113a8b8e2b07",
                "x-mitre-analytic--f571ba94-73ab-4590-ba2c-739a93cde075"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--8ae936b6-b635-4104-bd11-81c18d90cf97",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0744",
                    "external_id": "DET0744"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:13.720Z",
            "name": "Detection of Transient Cyber Asset",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--9127dd4e-0994-442f-8d73-b6b2dfb1f9ac",
                "x-mitre-analytic--b1b08627-62b0-4ede-b07d-478be9721f5a"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--930b268b-abf0-485f-9854-60c1cfdd2d33",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0748",
                    "external_id": "DET0748"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:42.798Z",
            "name": "Detection of Autorun Image",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--2b751a3d-c680-46c9-b92b-55a9d24bd4f9",
                "x-mitre-analytic--a607836b-d6d0-4501-8f05-b43a5dac09c8",
                "x-mitre-analytic--87efd969-d991-49be-9e41-24f5dbcff9e8"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--97914ffd-b189-415e-9309-e63e3be01b1e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0795",
                    "external_id": "DET0795"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:54.905Z",
            "name": "Detection of Exploitation for Evasion",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--fbd4686e-f637-459b-ad48-c6fd7840acfa",
                "x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4",
                "x-mitre-analytic--fe1b5de5-3919-480b-80b6-8914b6b1d098",
                "x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--9ad17e7a-5920-42ac-9bf4-545b99162640",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0792",
                    "external_id": "DET0792"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:52.970Z",
            "name": "Detection of Rogue Master",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--37d989e6-14cd-49a4-adec-3d8b72c8dc22",
                "x-mitre-analytic--f17cd473-1711-4a92-b8c7-a9890d432032",
                "x-mitre-analytic--b1e81f19-f241-45ef-bfa5-2aa27d99ee0c",
                "x-mitre-analytic--16dcc866-c1fc-4616-b985-235197cae399"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--9f3df5ac-caa0-4189-9b9b-dcf2f6bbdc54",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0722",
                    "external_id": "DET0722"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:05.325Z",
            "name": "Detection of Hooking",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8",
                "x-mitre-analytic--ad07439d-e13e-438a-9f4b-330d61f2607b",
                "x-mitre-analytic--05e52883-89d1-43f9-9836-d0dfc2f1d3e3",
                "x-mitre-analytic--5b7ee346-9061-4e8e-9bec-4d629cf488c5"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--a366d027-d797-4957-949a-870aed0766dd",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0754",
                    "external_id": "DET0754"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:04.241Z",
            "name": "Detection of Data from Information Repositories",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--1672d2e3-8756-4380-b22c-517aa9f1cce0",
                "x-mitre-analytic--5cf9cf41-4419-4d04-afcd-991dff638faf",
                "x-mitre-analytic--4053f72d-59c0-432e-a969-83217c586338"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--a995ba7c-c2c2-4d74-a3da-74e5a192099b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0763",
                    "external_id": "DET0763"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.687Z",
            "name": "Detection of Loss of View",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--1e9c5d46-14e2-4efc-8861-e6dc942b3b9c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ab3f0926-58e2-485e-987c-66b541d9de97",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0740",
                    "external_id": "DET0740"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:50.733Z",
            "name": "Detection of Exploit Public-Facing Application",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--dd25b818-ceb0-4518-9384-dcf895d4956b",
                "x-mitre-analytic--8b7ed6ba-ae88-48ab-8aa1-48c15e23db4d",
                "x-mitre-analytic--02e631a3-5ef0-436d-89bc-923fb32b80f0",
                "x-mitre-analytic--f91f4654-219f-47a4-aa5a-7c1597f23908"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ad675d25-2829-48e5-8475-28f1ed5d813a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0773",
                    "external_id": "DET0773"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.688Z",
            "name": "Detection of Manipulate I/O Image",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--7841eb6b-8a05-4754-b738-a475bfbb89fb"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ae24274b-0e20-451e-a883-6eeb0e8e7d00",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0747",
                    "external_id": "DET0747"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.688Z",
            "name": "Detection of Manipulation of Control",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--383a1a1c-8ecf-4909-9237-14a1f4fc4179"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--b04e83cc-8ace-4880-8953-7ce55eb8c427",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0756",
                    "external_id": "DET0756"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:14.879Z",
            "name": "Detection of Default Credentials",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--f12aa823-91cc-40e1-93b7-eaa5f5fa9c4d",
                "x-mitre-analytic--7d81a83b-ae31-4ceb-b469-bb8a914a751c",
                "x-mitre-analytic--45c339b2-55b1-4a8b-b21d-c53c3bf2b73a",
                "x-mitre-analytic--8744740c-e346-4a34-b0db-9c5540e65ed7"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--b25c4621-5d38-43ee-871e-0e5c02f2f48c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0765",
                    "external_id": "DET0765"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:46.543Z",
            "name": "Detection of Service Stop",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--6b3b3e92-bef7-4977-9895-29036bab29f1",
                "x-mitre-analytic--62ef9334-2cb2-436d-bd50-2ae1213704aa",
                "x-mitre-analytic--5346fb44-b04e-4820-8b14-eb62ee3a2ca8",
                "x-mitre-analytic--27e8a172-0682-4d23-a7c2-e2eac526ea9c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--b6a6d95c-e3b5-438d-a095-3fb0859c8f45",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0764",
                    "external_id": "DET0764"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:53.518Z",
            "name": "Detection of Adversary-in-the-Middle",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--afc9e394-147e-49db-81df-953d2d3ea93e",
                "x-mitre-analytic--46604667-aba2-403a-b41b-6e5a9f1494da",
                "x-mitre-analytic--a24f00d8-2d62-465a-a63c-5604058d195e",
                "x-mitre-analytic--7b5121f9-506c-40bf-81b2-df1042aa48b7"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--b817139c-2941-4523-bfb5-10c36d230871",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0781",
                    "external_id": "DET0781"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:50.533Z",
            "name": "Detection of Spearphishing Attachment",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--5610211c-1458-4333-8640-384189d9318e",
                "x-mitre-analytic--fde26204-97d9-4635-82c4-c7e3ed3c9a2c",
                "x-mitre-analytic--e3b493fc-9771-4e68-b7ec-e91556b22c46"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--bbb288c7-9e40-46bd-b0a1-db4cfef4e1ee",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0743",
                    "external_id": "DET0743"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:41.969Z",
            "name": "Detection of Wireless Sniffing",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--c14544a4-5ca1-4523-97eb-4a9840d74c6d",
                "x-mitre-analytic--86989bf4-0dfc-459e-aa67-86c9c02fcdf9",
                "x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c0abb110-c80e-4d6a-9f27-f2783f8bbfec",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0760",
                    "external_id": "DET0760"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.691Z",
            "name": "Detection of Command-Line Interface",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--7107739b-92d2-41fa-9fc8-ebe72f6086ee"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c0e6c96d-8605-407a-9bce-628e7853b07f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0746",
                    "external_id": "DET0746"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:51.861Z",
            "name": "Detection of Spoof Reporting Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--32bfb2ab-2ad1-4c00-8428-96bc626c34f3",
                "x-mitre-analytic--6e73b9c1-482d-44c7-b25b-e9b99764e987",
                "x-mitre-analytic--dc472b4e-7b39-4bbb-810e-acbf9998a767",
                "x-mitre-analytic--500aec57-cf41-4572-bdae-f08e185ebeec"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c1645705-a26f-45b2-aa68-ff5c93dfc0f4",
            "created": "2026-04-23T00:43:15.974Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0915",
                    "external_id": "DET0915"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:56.515Z",
            "name": "Detection of Online Edit",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--22b202f2-d4dd-44dd-b5e1-791ff2aef8ed"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c4777f1a-1481-4e8a-a3f4-0da57418c808",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0775",
                    "external_id": "DET0775"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.692Z",
            "name": "Detection of Loss of Protection",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--29b6e4b8-878c-4139-aa56-7e1513714d34"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c4ddc0d7-0296-4d92-9ae1-1a4b7b5d1640",
            "created": "2026-04-22T20:32:50.322Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0908",
                    "external_id": "DET0908"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:01.766Z",
            "name": "Detection of Broadcast Discovery",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--f6324642-d17d-49d4-90b2-bab9d229d6fa",
                "x-mitre-analytic--b3107fc4-e41d-4e1c-a895-6e6cdc9182ca",
                "x-mitre-analytic--beefb21a-0c89-4472-8a35-b1ac557018b5",
                "x-mitre-analytic--99652f40-1f48-4a01-9e09-0585e02ce534"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c7737640-99e8-4efb-90ee-39332b623b33",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0757",
                    "external_id": "DET0757"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.692Z",
            "name": "Detection of Loss of Productivity and Revenue",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--89ca8617-20fd-404b-9afb-dcfd2684a791"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c779ee07-ee85-42fe-a2c1-14ce25766cdf",
            "created": "2026-04-22T21:48:05.256Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0910",
                    "external_id": "DET0910"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:36.169Z",
            "name": "Detection of Block Communications",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--3f052beb-d384-4ebe-b942-2c4ddeb95833",
                "x-mitre-analytic--2b726f82-bb4f-4889-b6a0-4587f438cd83",
                "x-mitre-analytic--4ea5942d-fa95-484d-9acb-fe205a3960a3",
                "x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c7aea5e8-cd8b-4f79-be41-3a446cdde7b7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0796",
                    "external_id": "DET0796"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:16.202Z",
            "name": "Detection of Internet Accessible Device",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--87f5d864-d79b-474a-a3b4-43673dcb9f90",
                "x-mitre-analytic--5ac739da-7adb-491a-8ef9-694846572fc1",
                "x-mitre-analytic--952ff035-fa50-4462-85e1-ee0287b68922",
                "x-mitre-analytic--518d0e1a-b5e2-4c12-a36c-8d61ad58955e"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--c94af5cb-61c3-4180-81e7-30c1669f4252",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0774",
                    "external_id": "DET0774"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.692Z",
            "name": "Detection of I/O Image",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--c40ddd75-f2fc-4899-bda1-bff164c96622"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--cb273244-c117-4e32-afc7-f72f4e44e179",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0733",
                    "external_id": "DET0733"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:44.772Z",
            "name": "Detection of Replication Through Removable Media",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--9ad83be0-5c88-4fb6-b59d-19db21176923",
                "x-mitre-analytic--9510e414-3071-4e9c-af51-d07765393e32",
                "x-mitre-analytic--9a06af00-5f21-43c8-a4a3-24eaa28655c2",
                "x-mitre-analytic--b048b681-7bce-468e-896b-da76f8b81d49"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--d8cb1dd3-8bf2-48e7-99db-473481b823a8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0794",
                    "external_id": "DET0794"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:22.529Z",
            "name": "Detection of Unauthorized Command Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--23eb2bc3-735d-4425-96e1-f9d3a1453bfa",
                "x-mitre-analytic--bef23fc2-f276-4dc4-9e09-c3c546c431a1",
                "x-mitre-analytic--392fc0ea-dcf5-40cd-81ce-df2a9b90f8cc"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--d9469edc-7e55-41bc-8b17-a8db9fc6302e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0729",
                    "external_id": "DET0729"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.694Z",
            "name": "Detection of Loss of Availability",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--8428e0cd-009e-41c1-8292-88651d4486c9"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--de675cf4-144e-485c-a761-c72ebcb9e2bc",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0798",
                    "external_id": "DET0798"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.695Z",
            "name": "Detection of Hardcoded Credentials",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--b337bf06-d69b-41e0-8e60-8f24cb718998"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--e69d1e15-76e1-434c-bd45-0354a10dde8a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0790",
                    "external_id": "DET0790"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.696Z",
            "name": "Detection of Module Firmware",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--880a1133-6639-42f0-96a8-3e914426d38b"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--e6bc5359-4bd4-4688-9136-ac7a6b561f56",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0768",
                    "external_id": "DET0768"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.696Z",
            "name": "Detection of Detect Operating Mode",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--899d41e8-8d02-45f9-ab8a-3a06f4cc4189"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--e8b537e6-04eb-4168-a206-88cc041edf50",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0750",
                    "external_id": "DET0750"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:02.579Z",
            "name": "Detection of Indicator Removal on Host",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--55544bb8-440f-4b67-aa35-7e7af5952aca",
                "x-mitre-analytic--b26ae113-36e8-4ff4-94bb-bf058788979c",
                "x-mitre-analytic--6549a8ab-c92c-4249-a5f2-cd9d0458192d",
                "x-mitre-analytic--482edcb0-46cd-45b6-a373-2e9bbe2ffad2"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--e90f1c0c-f2c5-4fe1-942f-411574df043f",
            "created": "2026-04-23T00:32:34.211Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0914",
                    "external_id": "DET0914"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:57.455Z",
            "name": "Detection of Program Append",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--3c6aa6f7-29e9-41d9-8500-30b6d0533d64"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--e9f6c9ad-7368-43e3-9ba1-c9261323a1d1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0803",
                    "external_id": "DET0803"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:32.751Z",
            "name": "Detection of External Remote Services",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--908fe88b-d8e2-47d1-b6a4-7a42b3bbe09b",
                "x-mitre-analytic--03e474c2-49ff-4126-9a9a-e1f196d4a97b",
                "x-mitre-analytic--ec4eaf43-4490-4833-a18a-e475ab244970",
                "x-mitre-analytic--01d1755a-23ba-45d4-9cb9-00a7343d0da5"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--eabde43f-1872-499d-9642-85a6959c4d28",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0791",
                    "external_id": "DET0791"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:36.010Z",
            "name": "Detection of User Execution",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--d937e4b8-20f2-44c1-9940-48c74318c715",
                "x-mitre-analytic--cc87a984-9ec1-40c8-bcc3-14e9c51ef9fd",
                "x-mitre-analytic--88dc7850-3f62-4822-90c0-3a1ed06cc044"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ec442b22-3dc8-4b2b-8294-b76b0f01d748",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0739",
                    "external_id": "DET0739"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:35.079Z",
            "name": "Detection of Remote System Discovery",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--322ac45b-d540-4d2a-84a1-cde200238b95",
                "x-mitre-analytic--61dac9fe-69e8-40df-b573-e1eebff4cfc1",
                "x-mitre-analytic--695ad38a-7e5b-4d91-bab3-2388d3ae2f0b",
                "x-mitre-analytic--ca6b9523-4eba-48b2-8584-bed6fb3e6020"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--edf989d8-7e25-4ed2-b289-a55dee68a75e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0758",
                    "external_id": "DET0758"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:05.089Z",
            "name": "Detection of Data Destruction",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--f666f516-f8d0-41f6-9a4c-0ac6c1f6086b",
                "x-mitre-analytic--7f685d48-0d80-4ba4-8473-432c31b21da8",
                "x-mitre-analytic--928c559b-3258-4760-a785-ba1270d7ea92",
                "x-mitre-analytic--aa83b39c-238f-4592-abaa-35e011218f98"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f1a7e304-d05f-4e48-89b7-8b034f507c32",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0742",
                    "external_id": "DET0742"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:08.206Z",
            "name": "Detection of Execution through API",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--e8f51c53-fc55-441b-a45f-ba7709ccbce2",
                "x-mitre-analytic--8f09d2c6-0a02-486f-b468-f1e9519c35c7",
                "x-mitre-analytic--d8aba717-a6a9-4ded-815c-603dd4a44508",
                "x-mitre-analytic--99cde5ec-8f9f-4585-9195-5ed4509dc9cd"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f487a605-0acb-4b12-b157-33b75ebd9a40",
            "created": "2026-04-22T14:32:49.664Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0902",
                    "external_id": "DET0902"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:59.186Z",
            "name": "Detection of Unauthorized Message",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--613b28ef-88dd-4008-8d7e-206ce55a7cde",
                "x-mitre-analytic--18bf81d6-981c-49a2-9259-a08e1f1337b8",
                "x-mitre-analytic--89b7a519-ee8c-4aac-a9ef-f82d32116d30"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f4f3b9a6-2de0-45a5-8936-2ad9288191b9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0800",
                    "external_id": "DET0800"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:07.587Z",
            "name": "Detection of Network Sniffing",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--28eb77c1-1834-4b7a-a06f-afebb7f2e756",
                "x-mitre-analytic--9fac6c8a-9320-47d1-aa1d-3bdd4f5856d3",
                "x-mitre-analytic--795181c0-57b0-4c2f-ac9a-1c6a1c62b813",
                "x-mitre-analytic--9b1bb08d-5aba-47f4-86d7-a5788c99e1ac"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f9b7143b-ce86-4cfb-a03a-f39c01904fb1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0762",
                    "external_id": "DET0762"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.698Z",
            "name": "Detection of Damage to Property",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--636e612f-0b63-44e8-bf2c-31b62d20508b"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f9ea25e7-6e63-4ef1-a8ad-47a4a261e175",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0735",
                    "external_id": "DET0735"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.698Z",
            "name": "Detection of Scripting",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--302a5327-70cf-44b5-b592-ce9a62014dcc"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--fb0931d5-8eb9-4db2-a2a4-447c32b29bd4",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0779",
                    "external_id": "DET0779"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.698Z",
            "name": "Detection of Loss of Safety",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--8c77f31f-c6f4-491c-965a-e25c506b0c68"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--fddbd892-faa2-40e1-b40d-2c6e33c00f14",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0755",
                    "external_id": "DET0755"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.698Z",
            "name": "Detection of Change Operating Mode",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--78615cd7-6a14-4921-aaa9-2aae0774f0f1"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--fe11c904-752f-40e2-b269-c53bbb29541a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0741",
                    "external_id": "DET0741"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:34:50.698Z",
            "name": "Detection of Modify Controller Tasking",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--2195ec67-7cea-4b0d-a678-18384089bf2c"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--feb80c7a-96cd-4300-b344-4d75b176c9cb",
            "created": "2026-04-22T22:42:31.791Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0911",
                    "external_id": "DET0911"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:26.784Z",
            "name": "Detection of Block Ethernet",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--df7f8849-56a7-4e83-9fd7-a4f25227d960",
                "x-mitre-analytic--8cf7c363-594f-4efc-a1e8-30435b5f1feb",
                "x-mitre-analytic--a97db312-a06f-4020-aef2-b28bb8d78c56",
                "x-mitre-analytic--c17121b6-e945-4799-8a00-77d183501a1e"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ff6456fc-576d-4da5-b561-b58f70961b15",
            "created": "2026-04-22T16:29:50.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0905",
                    "external_id": "DET0905"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:17.910Z",
            "name": "Detection of Insecure Credentials",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--1017530e-423d-4857-80b6-99891bf82d28",
                "x-mitre-analytic--b968d9b9-b7f6-423b-b490-6a43ed97389f",
                "x-mitre-analytic--caa6869b-e752-4fb8-a228-09abaa2d321c",
                "x-mitre-analytic--74e60460-7618-4a7c-b490-c1e164784564"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--ffeac6e1-798f-41b1-8baf-2650d2ebe031",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0724",
                    "external_id": "DET0724"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:32.018Z",
            "name": "Detection of Valid Accounts",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--ddfcd948-3526-4241-a12f-d7bf63468e40",
                "x-mitre-analytic--d1985f23-da68-4b46-a5ab-9645ab91a25b",
                "x-mitre-analytic--e2a6f7a5-8316-4367-8e90-9d6560818250",
                "x-mitre-analytic--175f3f34-38ad-41ad-ae95-927479eacc14"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--6c7f2661-c4c3-40d6-ac41-2997bc069de9",
            "created": "2026-09-26T03:28:48.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0935",
                    "external_id": "DET0935"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:28:48.440Z",
            "name": "Behavioral Detection of Publish/Subscribe Protocol Misuse for Command and Control",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--5e0fd666-e460-4627-83ef-f7390752692e",
                "x-mitre-analytic--4e176b16-f17b-47dc-81a3-6a254edb1b50",
                "x-mitre-analytic--dab4f5e6-0560-4a00-96eb-41301b836ea4",
                "x-mitre-analytic--1532258f-43d7-41e9-ad80-aac5abdfcdc3"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--43a670e7-e016-4c29-8ec2-85c18e30f030",
            "created": "2026-09-26T02:41:26.112Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0934",
                    "external_id": "DET0934"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T02:41:26.112Z",
            "name": "Behavioral Detection of DNS Protocol Misuse for Command and Control",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--02172ea8-2b1a-41ec-a8d6-96b57ff9db9f",
                "x-mitre-analytic--7535c7b7-3046-44f2-b2ec-4faea6c5a21b",
                "x-mitre-analytic--65f5991b-df5e-4364-a579-e1ea5022a725",
                "x-mitre-analytic--d9136693-c5b4-4f26-b1d5-2a2ad637ca0e"
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--02172ea8-2b1a-41ec-a8d6-96b57ff9db9f",
            "created": "2026-09-26T02:39:43.087Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0934#AN2099",
                    "external_id": "AN2099"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T02:41:25.738Z",
            "name": "Analytic 2099",
            "description": "Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; connection to DNS/DoH destination with process identity"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:DNS",
                    "channel": "Native DNS query/response content: long/encoded labels, TXT use, unusual query structure"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedResolvers",
                    "description": "Site DNS resolvers and forwarding architecture"
                },
                {
                    "field": "ApprovedDoHProviders",
                    "description": "Explicitly permitted DoH/DoT endpoints, if any"
                },
                {
                    "field": "AuthorizedDoHProcesses",
                    "description": "Browsers/security/vendor software permitted to use encrypted DNS"
                },
                {
                    "field": "QueryPattern",
                    "description": "Length/entropy/type/frequency patterns used only as corroboration"
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "ICS assets that should not resolve/connect externally"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7535c7b7-3046-44f2-b2ec-4faea6c5a21b",
            "created": "2026-09-26T02:17:19.452Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0934#AN2097",
                    "external_id": "AN2097"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:45:49.464Z",
            "name": "Analytic 2097",
            "description": "Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NetworkDevice:IDS",
                    "channel": "DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:DNS",
                    "channel": "DNS query/response metadata and content"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Client-to-resolver or client-to-DoH endpoint flow"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedResolvers",
                    "description": "Authorized recursive resolvers/forwarders"
                },
                {
                    "field": "ApprovedDoHProviders",
                    "description": "Permitted encrypted DNS services"
                },
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Which ICS zones/assets may resolve externally"
                },
                {
                    "field": "QueryPattern",
                    "description": "Encoded/long labels, unusual types, entropy and periodicity as corroboration"
                },
                {
                    "field": "KnownDoHEndpoints",
                    "description": "Resolver/API destinations used to identify bypass"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--65f5991b-df5e-4364-a579-e1ea5022a725",
            "created": "2026-09-26T02:25:23.982Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0934#AN2098",
                    "external_id": "AN2098"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:44:49.870Z",
            "name": "Analytic 2098",
            "description": "Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "linux:osquery",
                    "channel": "socket_events to DNS/DoH/DoT destinations, where deployed"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:DNS",
                    "channel": "Native DNS query/response content"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "External DNS/HTTPS/TLS flow bypassing approved resolver/proxy"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedResolvers",
                    "description": "Site DNS resolvers"
                },
                {
                    "field": "ApprovedDoHProviders",
                    "description": "Permitted encrypted DNS endpoints"
                },
                {
                    "field": "AuthorizedProcesses",
                    "description": "Services permitted to resolve externally"
                },
                {
                    "field": "QueryPattern",
                    "description": "Tunneling-like query characteristics as corroboration"
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Assets with no legitimate external resolution"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d9136693-c5b4-4f26-b1d5-2a2ad637ca0e",
            "created": "2026-09-26T02:11:00.777Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0934#AN2096",
                    "external_id": "AN2096"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:46:15.444Z",
            "name": "Analytic 2096",
            "description": "Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:TLS/HTTP",
                    "channel": "SNI/HTTP host or resolver endpoint identification when observable"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:DNS",
                    "channel": "Device DNS query/response content"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Device-to-resolver/DoH destination flow"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DeviceResolverProfile",
                    "description": "Expected DNS resolver(s) per device/model/site"
                },
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Vendor/cloud domains required for operation"
                },
                {
                    "field": "ApprovedDoHProviders",
                    "description": "Permitted encrypted DNS, normally empty for fixed-function devices"
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Devices that should not resolve externally"
                },
                {
                    "field": "QueryPattern",
                    "description": "Tunneling characteristics used as corroboration, not sole trigger"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8c95b5df-75bb-4fea-8a3e-a6b9f2ddf64e",
            "created": "2026-09-25T17:53:40.395Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0929#AN2086",
                    "external_id": "AN2086"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T17:56:20.295Z",
            "name": "Analytic 2086",
            "description": "Real-time monitoring identifies direct PowerShell execution or indirect System.Management.Automation use with an unexpected parent, encoded/obfuscated arguments, unusual module loading, or execution followed by OT-relevant network/process activity. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; powershell/pwsh or suspicious parent-child chain"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=4103/4104/4105/4106; command/script-block content "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "WinEventLog:PowerShell",
                    "channel": "EventCode=400/403; engine lifecycle/context"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7; System.Management.Automation or unusual PowerShell-related modules"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedPowerShellUse",
                    "description": "Approved scripts, modules, hosts, service accounts, and vendor workflows"
                },
                {
                    "field": "ParentProcessName",
                    "description": "Expected parents for engineering/administrative PowerShell"
                },
                {
                    "field": "CommandLinePattern",
                    "description": "Encoded, hidden, download, reflection, remoting, or ICS/API-related arguments"
                },
                {
                    "field": "MaintenanceWindow",
                    "description": "Approved change/diagnostic periods"
                },
                {
                    "field": "ProtectedOTDestinations",
                    "description": "Controllers, HMIs, historians, gateways, and engineering assets where follow-on activity raises fidelity"
                }
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--f8400e7d-3443-4205-aaf3-1592b777416f",
            "created": "2026-09-25T17:56:20.465Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0929",
                    "external_id": "DET0929"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:45:14.263Z",
            "name": "Behavioral Detection of PowerShell Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--8c95b5df-75bb-4fea-8a3e-a6b9f2ddf64e"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--260bc795-4a3d-4ca6-8fd1-5e687112d20c",
            "created": "2026-09-25T16:53:28.157Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0928",
                    "external_id": "DET0928"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T22:42:10.773Z",
            "name": "Behavioral Detection of Command and Scripting Abuse in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--0d570cdf-f503-43b1-a3be-5ee485379576",
                "x-mitre-analytic--3fef48cc-6e1f-4a2f-9a1e-a8a0e43c3c20",
                "x-mitre-analytic--eb0833b1-5675-43df-84cb-3c185653326a",
                "x-mitre-analytic--c7880711-79fa-4ea5-9c77-b7d59a9740be"
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--0d570cdf-f503-43b1-a3be-5ee485379576",
            "created": "2026-09-25T16:58:28.788Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0928#AN2082",
                    "external_id": "AN2082"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T22:50:12.793Z",
            "name": "Analytic 2082",
            "description": "Real-time monitoring identifies a command-line interpreter (cmd.exe, PowerShell.exe) spawned as a child of an Industrial Control System (ICS) vendor application process, where this parent-child relationship is not part of the documented normal operation of that vendor software or directly spawned processes with a command line parameters containing ICS protocol/Application Programming Interface (API) interaction keywords, from a context not associated with documented automation scripts. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "HighRiskCLICommands",
                    "description": "List of CLI command patterns considered high-risk warranting elevated scrutiny."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3fef48cc-6e1f-4a2f-9a1e-a8a0e43c3c20",
            "created": "2026-09-25T17:08:24.981Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0928#AN2083",
                    "external_id": "AN2083"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:23:47.307Z",
            "name": "Analytic 2083",
            "description": "Real-time monitoring identifies a command and scripting interpreter process spawned by an Industrial Control System (ICS) service process, or interactive shell sessions from unexpected Secure Shell (SSH) source Internet Protocol (IP) addresses or an unexpected User Identifier (UID) not associated with recognized ICS automation scripts, deviating from the expected execution baseline. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. \n\n",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "HighRiskCLICommands",
                    "description": "List of CLI command patterns considered high-risk warranting elevated scrutiny."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--98e017f6-93cd-46d0-8923-13a7697965a7",
            "created": "2026-09-25T19:02:09.023Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0930#AN2087",
                    "external_id": "AN2087"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:05:32.264Z",
            "name": "Analytic 2087",
            "description": "Real-time monitoring identifies cmd.exe or .bat/.cmd execution from an unexpected parent or user context, execution from transient/user-writable paths, suspicious command chaining, or shell activity followed by OT-relevant discovery, credential, remote-access, or configuration behavior. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=4688; cmd.exe/batch execution with parent and command line "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; process lineage and command line"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ParentProcessName",
                    "description": "Approved vendor applications/services that legitimately spawn cmd.exe"
                },
                {
                    "field": "CommandLinePattern",
                    "description": "Chaining, discovery, remote execution, file transfer, or ICS tool/API invocation"
                },
                {
                    "field": "ScriptStoragePath",
                    "description": "Approved batch/script locations"
                },
                {
                    "field": "UserContext",
                    "description": "Authorized operator/engineer/service identities"
                },
                {
                    "field": "MaintenanceWindow",
                    "description": "Approved changes and support Windows"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a5255607-9d66-473a-ac88-8b4d0f2527f3",
            "created": "2026-09-25T19:29:31.248Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0931#AN2088",
                    "external_id": "AN2088"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:26:54.586Z",
            "name": "Analytic 2088",
            "description": "Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "execve for shell/interpreter and child commands "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "linux:syslog",
                    "channel": "auth.log/secure.log; SSH or console session context "
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ShellExecutable",
                    "description": "Approved shell paths and BusyBox use"
                },
                {
                    "field": "ParentProcess",
                    "description": "Expected service/vendor parents"
                },
                {
                    "field": "UserContext",
                    "description": "Authorized users and service accounts"
                },
                {
                    "field": "RemoteSource",
                    "description": "Approved jump hosts and management subnets "
                },
                {
                    "field": "CommandLinePattern",
                    "description": "High-risk shell commands and ICS-relevant follow-on activity "
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a5361f96-a1da-426b-9211-33f29d7d217a",
            "created": "2026-09-25T19:36:52.622Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0931#AN2089",
                    "external_id": "AN2089"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:27:52.135Z",
            "name": "Analytic 2089",
            "description": "Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "networkdevice:syslog",
                    "channel": "CLI command audit / configuration command history"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "networkdevice:auth",
                    "channel": "SSH/Telnet/console authentication and session creation"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementSources ",
                    "description": "Jump hosts, management VLANs, and administrative CIDRs "
                },
                {
                    "field": "AuthorizedAccounts ",
                    "description": "Named/network-service administrative accounts "
                },
                {
                    "field": "HighRiskCommands ",
                    "description": "Enable/configure, ACL, route, NAT, firmware, file transfer, shell escape "
                },
                {
                    "field": "ChangeWindow ",
                    "description": "Approved network maintenance/change ticket window "
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c7880711-79fa-4ea5-9c77-b7d59a9740be",
            "created": "2026-09-25T17:21:55.307Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0928#AN2085",
                    "external_id": "AN2085"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:25:14.907Z",
            "name": "Analytic 2085",
            "description": "Real-time monitoring identifies a session (Telnet, SSH, proprietary, etc.) opened to an embedded field device from a source not in the approved administrative CIDR, immediately followed by configuration-mode entry or high-risk commands (firmware operations, config write/erase, reload) or identifies sequences of Industrial Control System (ICS) protocol commands arriving at field devices that follow a scripted, deterministic pattern -- identical inter-command timing, systematic address iteration -- rather than the variable, operator-driven timing of legitimate engineering sessions. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "device:cli",
                    "channel": "Shell command"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "HighRiskCLICommands",
                    "description": "List of CLI command patterns considered high-risk warranting elevated scrutiny."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--eb0833b1-5675-43df-84cb-3c185653326a",
            "created": "2026-09-25T17:17:26.140Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0928#AN2084",
                    "external_id": "AN2084"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:24:28.074Z",
            "name": "Analytic 2084",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) network-device command-line interface (CLI) commands (e.g., interface shutdown, access control list modification, network address translation changes, etc.) from a source or account outside the approved network-management baseline or network traffic patterns consistent with scripted command execution -- regular-interval connections with consistent payload sizes -- to field device Internet Protocol (IP) addresses from a host not normally exhibiting such regularity. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "networkdevice:cli",
                    "channel": "shell command"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "HighRiskCLICommands",
                    "description": "List of CLI command patterns considered high-risk warranting elevated scrutiny."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--0a622741-8425-4d8a-8e04-4631a7e049bf",
            "created": "2026-09-25T20:18:42.069Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0932#AN2091",
                    "external_id": "AN2091"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:40:41.056Z",
            "name": "Analytic 2091",
            "description": "Real-time monitoring identifies wscript.exe/cscript.exe, Office macro, or HTA-driven Visual Basic execution from unexpected parents/paths or followed by PowerShell, command shell, network activity, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon ",
                    "channel": "EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog",
                    "channel": "EventCode=7; vbscript.dll/scrrun.dll or unusual scripting-engine modules "
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ParentProcess",
                    "description": "Approved Office/vendor application relationships \n\n"
                },
                {
                    "field": "ScriptLocation ",
                    "description": "Approved script/macro paths versus temp/download/user-writable paths "
                },
                {
                    "field": "UserContext ",
                    "description": "Authorized users/service accounts "
                },
                {
                    "field": "ModuleName ",
                    "description": "VB scripting engine modules expected on the asset "
                },
                {
                    "field": "MaintenanceWindow ",
                    "description": "Approved business/engineering automation periods "
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--39f27e29-f5cc-4bb8-b1d5-5e55c1a4688e",
            "created": "2026-09-25T20:57:06.684Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0936#AN2092",
                    "external_id": "AN2092"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:35:09.853Z",
            "name": "Analytic 2092",
            "description": "Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon ",
                    "channel": "EventCode=1; wscript.exe/cscript.exe/mshta.exe and child-process lineage "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7; scripting-engine module loads when useful "
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedScriptHosts",
                    "description": "Allowed script hosts and vendor applications"
                },
                {
                    "field": "ParentProcess",
                    "description": "Expected parent-child relationships"
                },
                {
                    "field": "ScriptPath",
                    "description": "Approved script locations"
                },
                {
                    "field": "UserContext",
                    "description": "Authorized users/services"
                },
                {
                    "field": "MaintenanceWindow",
                    "description": "Approved automation/support windows"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--50e94b5a-3b2b-450d-a33c-c6b0d72f7b50",
            "created": "2026-09-25T19:49:12.249Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0931#AN2090",
                    "external_id": "AN2090"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:28:20.669Z",
            "name": "Analytic 2090",
            "description": "Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone. ",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "device:CLI",
                    "channel": "Device shell/CLI command audit when available "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "device:auth",
                    "channel": "SSH/Telnet/console or vendor remote-management session "
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementSources ",
                    "description": "Engineering workstations/jump hosts permitted to administer the device "
                },
                {
                    "field": "AuthorizedAccounts ",
                    "description": "Approved local/vendor accounts "
                },
                {
                    "field": "HighRiskCommands ",
                    "description": "Firmware, configuration write/erase, service manipulation, shell escape "
                },
                {
                    "field": "DeviceRole ",
                    "description": "Whether interactive shell/CLI is expected on this device class "
                },
                {
                    "field": "MaintenanceWindow ",
                    "description": "Approved vendor/engineering activity "
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8c1a6dd8-6706-44cb-93b1-c29491ab9702",
            "created": "2026-09-25T20:59:08.668Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0936#AN2093",
                    "external_id": "AN2093"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:35:09.854Z",
            "name": "Analytic 2093",
            "description": "Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "execve for node/nodejs or JavaScript runtime and child processes "
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "linux:osquery",
                    "channel": "socket_events for runtime-originated connections, where deployed "
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedRuntime",
                    "description": "Approved Node.js/runtime paths and versions"
                },
                {
                    "field": "ParentProcess",
                    "description": "Expected service/application parents"
                },
                {
                    "field": "ScriptPath",
                    "description": "Approved application/script locations"
                },
                {
                    "field": "UserContext",
                    "description": "Expected service users"
                },
                {
                    "field": "ApprovedDestinations",
                    "description": "Expected OT/external communications"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--bffafc31-542c-45f0-9af1-73e2a789f782",
            "created": "2026-09-25T22:00:20.938Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0933#AN2095",
                    "external_id": "AN2095"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:31:18.686Z",
            "name": "Analytic 2095",
            "description": "Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "execve for python/python3 and script path/arguments"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "linux:osquery",
                    "channel": "socket_events for Python-originated connections, where deployed"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedPythonInstallations",
                    "description": "Expected interpreter paths and vendor-embedded Python"
                },
                {
                    "field": "ScriptDir",
                    "description": "Approved automation paths versus /tmp, /var/tmp, hidden/user paths"
                },
                {
                    "field": "ScheduledContext",
                    "description": "Approved cron/systemd jobs"
                },
                {
                    "field": "UserContext",
                    "description": "Expected service/engineering accounts"
                },
                {
                    "field": "ApprovedDestinations",
                    "description": "Expected OT/external communications"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d9d759b9-6bd5-4c26-8872-cd0ccc173959",
            "created": "2026-09-25T21:34:56.341Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0933#AN2094",
                    "external_id": "AN2094"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:47:44.692Z",
            "name": "Analytic 2094",
            "description": "Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1; Python interpreter/script execution and lineage"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; Python-originated connection to OT or external destination"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedPythonInstallations",
                    "description": "Approved interpreter paths/hashes and embedded vendor runtimes"
                },
                {
                    "field": "ScriptPath",
                    "description": "Approved automation repositories versus temp/user-writable paths"
                },
                {
                    "field": "ParentProcess",
                    "description": "Expected vendor/engineering parents"
                },
                {
                    "field": "UserContext",
                    "description": "Authorized automation/service accounts"
                },
                {
                    "field": "ApprovedDestinations",
                    "description": "OT and external destinations Python may legitimately access"
                }
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--4a2e4d0b-dd28-4b0d-8b83-8c9e66826c62",
            "created": "2026-09-25T19:05:32.433Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0930",
                    "external_id": "DET0930"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:05:32.433Z",
            "name": "Behavioral Detection of Windows Command Shell Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--98e017f6-93cd-46d0-8923-13a7697965a7"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--02744e21-5d1c-4290-820f-d355fc044f50",
            "created": "2026-09-25T20:00:54.346Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0931",
                    "external_id": "DET0931"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:00:54.346Z",
            "name": "Behavioral Detection of Unix Shell Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--a5255607-9d66-473a-ac88-8b4d0f2527f3",
                "x-mitre-analytic--a5361f96-a1da-426b-9211-33f29d7d217a",
                "x-mitre-analytic--50e94b5a-3b2b-450d-a33c-c6b0d72f7b50"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--57970b21-17a5-4536-a089-5277ebc575f9",
            "created": "2026-09-25T20:40:41.184Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0932",
                    "external_id": "DET0932"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T13:30:13.534Z",
            "name": "Behavioral Detection of Visual Basic Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--0a622741-8425-4d8a-8e04-4631a7e049bf"
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--045550b2-8bb3-43ee-92fc-214f955fabdc",
            "created": "2026-09-26T01:47:44.862Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0933",
                    "external_id": "DET0933"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:47:44.862Z",
            "name": "Behavioral Detection of Python Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--d9d759b9-6bd5-4c26-8872-cd0ccc173959",
                "x-mitre-analytic--bffafc31-542c-45f0-9af1-73e2a789f782"
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1532258f-43d7-41e9-ad80-aac5abdfcdc3",
            "created": "2026-09-26T03:27:26.573Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0935#AN2103",
                    "external_id": "AN2103"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T13:21:45.013Z",
            "name": "Analytic 2103",
            "description": "Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Pub/sub protocol, client ID, topic/queue and message metadata when observable"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Device-to-broker flow metadata"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "NSM:Connections",
                    "channel": "New device-to-broker relationship outside documented profile"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DeviceBrokerProfile",
                    "description": "Expected broker(s) for each device/model/site"
                },
                {
                    "field": "ApprovedClientIDs",
                    "description": "Expected client identity/certificate where observable"
                },
                {
                    "field": "ApprovedTopics",
                    "description": "Expected publish/subscribe topic namespace"
                },
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Expected telemetry cadence used only as corroboration"
                },
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Expected telemetry cadence used only as corroboration"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--dab4f5e6-0560-4a00-96eb-41301b836ea4",
            "created": "2026-09-26T03:21:18.721Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0935#AN2102",
                    "external_id": "AN2102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T13:21:11.422Z",
            "name": "Analytic 2102",
            "description": "Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Source/destination/port/session metadata"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "NetworkDevice:Syslog",
                    "channel": "Permitted/denied connection creation where network devices record it"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedBrokers",
                    "description": "Broker IP/FQDN/service inventory"
                },
                {
                    "field": "ApprovedClientIDs",
                    "description": "Expected MQTT/AMQP client identities where observable"
                },
                {
                    "field": "ApprovedTopics",
                    "description": "Expected publish/subscribe topic namespaces"
                },
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Allowed zone/client/broker relationships"
                },
                {
                    "field": "TLSProfile",
                    "description": "Expected encrypted/unencrypted protocol use and certificate identities"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4e176b16-f17b-47dc-81a3-6a254edb1b50",
            "created": "2026-09-26T03:16:11.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0935#AN2101",
                    "external_id": "AN2101"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T13:31:24.947Z",
            "name": "Analytic 2101",
            "description": "Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "linux:osquery",
                    "channel": "socket_events to broker/service, where deployed"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "MQTT/AMQP/DDS protocol and message metadata when visible"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Client/broker flow metadata"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedBrokers",
                    "description": "Authorized brokers/services"
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Approved client processes/services"
                },
                {
                    "field": "ApprovedTopics",
                    "description": "Expected topics/queues where observable"
                },
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Allowed client/broker relationships"
                },
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Expected telemetry cadence"
                }
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5e0fd666-e460-4627-83ef-f7390752692e",
            "created": "2026-09-26T03:08:40.952Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0935#AN2100",
                    "external_id": "AN2100"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:28:48.088Z",
            "name": "Analytic 2100",
            "description": "Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3; process-to-broker connection"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "Client/broker connection metadata and periodicity"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedBrokers",
                    "description": "Authorized broker/service destinations"
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Processes/services permitted to publish/subscribe"
                },
                {
                    "field": "ApprovedTopics",
                    "description": "Expected topics/queues/domains where observable"
                },
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Allowed source-to-broker relationships"
                },
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Expected telemetry/reporting cadence as corroboration"
                }
            ]
        },
        {
            "type": "x-mitre-detection-strategy",
            "spec_version": "2.1",
            "id": "x-mitre-detection-strategy--a24f6d21-a614-46bd-9817-f55a576a05ea",
            "created": "2026-10-05T19:35:10.217Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0936",
                    "external_id": "DET0936"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-05T19:35:10.217Z",
            "name": "Behavioral Detection of JavaScript Execution in ICS",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_analytic_refs": [
                "x-mitre-analytic--39f27e29-f5cc-4bb8-b1d5-5e55c1a4688e",
                "x-mitre-analytic--8c1a6dd8-6706-44cb-93b1-c29491ab9702"
            ]
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--01d1755a-23ba-45d4-9cb9-00a7343d0da5",
            "created": "2026-10-13T17:47:32.603Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0803#AN2265",
                    "external_id": "AN2265"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:32.603Z",
            "name": "Analytic 2265",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS)-role account session originating from a Virtual Private Network (VPN)/remote access connection that subsequently accesses Windows ICS hosts in a pattern inconsistent with documented vendor support session profiles. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedRemoteAccessOrigins",
                    "description": "Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."
                },
                {
                    "field": "ExpectedSessionPattern",
                    "description": "Baseline of normal session timing/duration for each ICS-role account's remote access usage."
                },
                {
                    "field": "RemoteAccessToICSWindow",
                    "description": "Time window correlating VPN authentication with subsequent ICS-zone network access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--02e631a3-5ef0-436d-89bc-923fb32b80f0",
            "created": "2026-10-13T17:45:35.993Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0740#AN2173",
                    "external_id": "AN2173"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:35.993Z",
            "name": "Analytic 2173",
            "description": "Real-time monitoring identifies exploit-pattern HTTP/HTTPS traffic targeting an ICS DMZ application from a source or request pattern outside the approved application baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate access to the ICS web interface is expected."
                },
                {
                    "field": "ExploitPatternSignatures",
                    "description": "Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."
                },
                {
                    "field": "ExploitToShellWindow",
                    "description": "Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--03e474c2-49ff-4126-9a9a-e1f196d4a97b",
            "created": "2026-10-13T17:46:40.560Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0803#AN2224",
                    "external_id": "AN2224"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:40.560Z",
            "name": "Analytic 2224",
            "description": "Near-real-time connection monitoring identifies connections to Industrial Control System (ICS) field device management ports from Internet Protocol (IP) addresses routed through external remote access infrastructure rather than from within the expected ICS network segments. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedRemoteAccessOrigins",
                    "description": "Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."
                },
                {
                    "field": "ExpectedSessionPattern",
                    "description": "Baseline of normal session timing/duration for each ICS-role account's remote access usage."
                },
                {
                    "field": "RemoteAccessToICSWindow",
                    "description": "Time window correlating VPN authentication with subsequent ICS-zone network access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--04d594f0-5158-4965-a81d-f757f841bbe1",
            "created": "2026-10-13T17:47:09.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0751#AN2250",
                    "external_id": "AN2250"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:09.902Z",
            "name": "Analytic 2250",
            "description": "Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded Human-Machine Interface (HMI) panel's built-in web server capturing screen images, or Virtual Network Computing (VNC) connections to embedded HMI panels, from source Internet Protocol (IP) addresses not in the approved operator workstation list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Virtual Network Computing (VNC) connection or screen-capture Hypertext Transfer Protocol (HTTP) request to embedded Human-Machine Interface (HMI) panel from source not in approved operator workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedScreenCaptureTools",
                    "description": "Allowlist of remote support, training, or documentation tools legitimately authorized to perform screen capture."
                },
                {
                    "field": "CaptureToFileWindow",
                    "description": "Time window correlating a screen capture API call with a subsequent image file write."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--05e52883-89d1-43f9-9836-d0dfc2f1d3e3",
            "created": "2026-10-13T17:47:00.577Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0722#AN2243",
                    "external_id": "AN2243"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:00.577Z",
            "name": "Analytic 2243",
            "description": "Detect embedded hooking by correlating an independently acquired firmware/module integrity measurement that differs from the approved vendor/baseline image with protocol-response behavior that also departs from the device's known deterministic behavior. A protocol-response anomaly by itself does not prove a hook because firmware versions, device state, communications faults, and vendor-specific behavior can produce response differences. Treat network anomalies as corroboration and require independent integrity evidence or vendor/device attestation before escalating the condition as firmware-level hooking. Monitoring mode: periodic or event-triggered integrity verification plus near-real-time protocol monitoring where a capable OT protocol decoder is deployed.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "deterministic function code response content diverges from the device's established per-function response baseline without a corresponding firmware update event"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "independently acquired firmware/module hash or vendor integrity measurement differs from approved baseline; protocol-response anomalies are corroboration only"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedICSVendorProcessList",
                    "description": "Allowlist of processes permitted to install window/event hooks on ICS engineering and HMI hosts."
                },
                {
                    "field": "ICSServiceBinaryList",
                    "description": "List of binary paths for ICS gateway, OPC, and historian services on Linux assets that should never be launched with LD_PRELOAD set."
                },
                {
                    "field": "VendorPackageManifest",
                    "description": "Package manager manifest cross-reference confirming a shared library belongs to an installed, signed package."
                },
                {
                    "field": "VendorSignedDLLHashBaseline",
                    "description": "Cryptographic hash inventory of all vendor-signed ICS communication DLLs, refreshed on every legitimate vendor patch cycle."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--060b84bc-0f25-4643-aa26-f98f32e6a860",
            "created": "2026-10-13T17:45:12.847Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0804#AN2159",
                    "external_id": "AN2159"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:12.847Z",
            "name": "Analytic 2159",
            "description": "Real-time monitoring identifies SSH lateral movement between Industrial Control System (ICS) Linux hosts not in the documented communication matrix, with subsequent ICS tool execution or privilege escalation. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Comprehensive matrix of expected inter-host communication on remote service ports."
                },
                {
                    "field": "ApprovedLateralMovementPairs",
                    "description": "Documented, approved host-to-host remote access pairs within the ICS network."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--073153c5-a2dc-4985-b5f0-b0ee35f5457c",
            "created": "2026-10-13T17:45:38.485Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0759#AN2175",
                    "external_id": "AN2175"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:38.485Z",
            "name": "Analytic 2175",
            "description": "Real-time monitoring identifies a host simultaneously maintaining an inbound connection on an Industrial Control System (ICS) protocol port and an outbound connection to a destination outside the ICS network zone, detectable as correlated dual flows with matching timing and approximate byte-count proportionality. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "RelayCorrelationWindow",
                    "description": "Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--0aa3c64b-e708-4fe2-9764-af61670e1172",
            "created": "2026-10-13T17:44:28.398Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0727#AN2125",
                    "external_id": "AN2125"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:28.398Z",
            "name": "Analytic 2125",
            "description": "Real-time monitoring identifies a scripting interpreter or custom binary on an Industrial Control System (ICS) Linux asset making sustained, high-frequency Industrial Control System (ICS) protocol read connections to field device IPs, from a User Identifier (UID) not associated with the recognized historian or Supervisory Control and Data Acquisition (SCADA) service account. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to connect."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices."
                },
                {
                    "field": "BaselinePollRate",
                    "description": "Measured normal polling frequency per device, derived from actual baseline traffic capture."
                },
                {
                    "field": "KnownTagAddressRanges",
                    "description": "Documented register/tag address ranges that legitimate SCADA polling actually queries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--13b48db7-e4d4-47a3-8bd1-60f9c2a039da",
            "created": "2026-10-13T17:44:54.658Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0776#AN2145",
                    "external_id": "AN2145"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:54.658Z",
            "name": "Analytic 2145",
            "description": "Real-time monitoring identifies a Linux process invoking Industrial Control System (ICS) vendor write Application Programming Interfaces (APIs) or Open Platform Communications (OPC) Unified Architecture (UA) write calls to setpoint tags on field devices, from a User Identifier (UID) not associated with the authorized control application, with values exceeding the safe operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to parameter/setpoint registers."
                },
                {
                    "field": "BaselineValueRange",
                    "description": "Documented safe operating range for each monitored parameter."
                },
                {
                    "field": "ParameterDriftThreshold",
                    "description": "Percentage deviation from rolling baseline considered significant drift."
                },
                {
                    "field": "SetpointAddressRange",
                    "description": "Register/address ranges corresponding to parameter and setpoint values for the device type."
                },
                {
                    "field": "TimeWindow",
                    "description": "Time window over which post-write drift is measured."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419",
            "created": "2026-10-13T17:47:36.018Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0910#AN2267",
                    "external_id": "AN2267"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:36.018Z",
            "name": "Analytic 2267",
            "description": "Real-time monitoring identifies Windows firewall rule additions blocking Industrial Control System (ICS) protocol ports on ICS gateway or server hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--746f095a-f84c-4ccc-90a5-c7caa5c100a2",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): Windows Firewall rule added blocking Industrial Control Systems (ICS) protocol ports by account not in authorized firewall admins"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for network infrastructure configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which connectivity-affecting changes are authorized."
                },
                {
                    "field": "CommBlockCorrelationWindow",
                    "description": "Time window correlating a configuration change with subsequent communication loss."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--154de82d-e589-4dab-ae2a-42a61dc1443a",
            "created": "2026-10-13T17:47:56.547Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0799#AN2281",
                    "external_id": "AN2281"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:56.547Z",
            "name": "Analytic 2281",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Windows host making outbound connections on HTTP/HTTPS/DNS ports to destinations outside the approved Industrial Control System (ICS) communication baseline, from processes that are not recognized Industrial Control System (ICS) vendor applications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor/business domains for application-layer protocol traffic."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose role does not require external application-layer connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--16dcc866-c1fc-4616-b985-235197cae399",
            "created": "2026-10-13T17:47:52.823Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0792#AN2278",
                    "external_id": "AN2278"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:52.823Z",
            "name": "Analytic 2278",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol master-role traffic originating from a Windows host that is not the authorized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP/identity allowlist of legitimate master/control server systems."
                },
                {
                    "field": "RegisteredMasterAddresses",
                    "description": "Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."
                },
                {
                    "field": "RogueMasterTimeWindow",
                    "description": "Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--175f3f34-38ad-41ad-ae95-927479eacc14",
            "created": "2026-10-13T17:46:31.857Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0724#AN2217",
                    "external_id": "AN2217"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:31.857Z",
            "name": "Analytic 2217",
            "description": "Real-time monitoring identifies field device access (Industrial Control System (ICS) protocol sessions, management interface authentication) using credentials or authentication tokens associated with a legitimate engineering account, but from a source Internet Protocol (IP) address or Media Access Control (MAC) address not enrolled as an authorized engineering workstation, where the authenticated session subsequently performs write operations the credential owner has not acknowledged via change control. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedAdminCIDR",
                    "description": "IP ranges from which SSH administrative access to ICS Linux assets is authorized."
                },
                {
                    "field": "ApprovedHostList",
                    "description": "Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."
                },
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges from which network device administrative access is authorized."
                },
                {
                    "field": "AuthToDeviceWindow",
                    "description": "Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."
                },
                {
                    "field": "ICSRoleAccountPatterns",
                    "description": "Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."
                },
                {
                    "field": "OfficeHoursWindow",
                    "description": "Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--17713d7e-3d88-47b0-b5b0-fd60cd90bf86",
            "created": "2026-10-13T17:45:51.944Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0801#AN2187",
                    "external_id": "AN2187"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:51.944Z",
            "name": "Analytic 2187",
            "description": "Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to power Management Information Base (MIB) restart Object Identifiers (OIDs) or Command Line Interface (CLI) reload commands from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which restarts are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--18409dae-85cb-4460-a2a6-f287991f0dca",
            "created": "2026-10-13T17:45:04.204Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0793#AN2152",
                    "external_id": "AN2152"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:04.204Z",
            "name": "Analytic 2152",
            "description": "Real-time monitoring identifies system binaries (bash, python, perl, awk, dd) on Industrial Control System (ICS) Linux assets executing with arguments that pipe or decode external content rather than performing their documented administrative function. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID)"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of ICS hosts warranting this elevated monitoring."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--18bf81d6-981c-49a2-9259-a08e1f1337b8",
            "created": "2026-10-13T17:45:14.299Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0902#AN2160",
                    "external_id": "AN2160"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:14.299Z",
            "name": "Analytic 2160",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol library loaded by a Linux process not in the authorized ICS applications list, making connections to the device subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationBaseline",
                    "description": "The complete, maintained inventory of every legitimate source-to-destination communication pair in the ICS environment."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--197be8a2-8569-4304-9fe8-b987c8ed79b1",
            "created": "2026-10-13T17:45:30.374Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0723#AN2168",
                    "external_id": "AN2168"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:30.374Z",
            "name": "Analytic 2168",
            "description": "Real-time monitoring of switch/router interface counters identifies a sudden spike in discarded or errored packets on an Industrial Control System (ICS)-facing interface combined with Central Processing Unit (CPU) utilization climbing above baseline, correlated with loss of reachability to downstream field devices on that segment within the same window. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:snmp",
                    "channel": "ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CPUUtilizationThreshold",
                    "description": "Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."
                },
                {
                    "field": "DoSConnectionThreshold",
                    "description": "Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."
                },
                {
                    "field": "DoSDetectionWindow",
                    "description": "Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."
                },
                {
                    "field": "ExpectedPollInterval",
                    "description": "Device-specific supervisory poll interval used to determine what counts as a process historian gap."
                },
                {
                    "field": "InterfaceErrorThreshold",
                    "description": "Deviation from baseline interface error/discard rate, tuned against historical interface health data."
                },
                {
                    "field": "MalformedPacketThreshold",
                    "description": "Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--1f5ec3e0-2b7d-4b6d-992b-c5849911df1e",
            "created": "2026-10-13T17:44:29.546Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0731#AN2126",
                    "external_id": "AN2126"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:29.546Z",
            "name": "Analytic 2126",
            "description": "Real-time monitoring identifies a firmware update utility on an Industrial Control System (ICS) Linux engineering host initiating a connection to a device Internet Protocol (IP) address on its firmware update port, by a User Identifier (UID) not in the approved firmware manager UIDs, outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): firmware updater connecting to device on firmware port, by User Identifier (UID) not in authorized firmware manager UIDs, outside maintenance window schedule"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFirmwareInventory",
                    "description": "Cryptographic hash inventory of authorized firmware versions per device model."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update operations."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform firmware updates."
                },
                {
                    "field": "FirmwareSessionSizeThreshold",
                    "description": "Minimum byte count for a session to be considered a firmware transfer rather than routine configuration traffic, derived from known firmware image sizes."
                },
                {
                    "field": "FirmwareUpdateWindow",
                    "description": "Time window within which a device reboot following a large session is considered part of the same firmware update event."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware updates are expected to occur."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--21e2074e-f7d9-4a41-87e6-d365ac99a972",
            "created": "2026-10-13T17:47:11.077Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0772#AN2251",
                    "external_id": "AN2251"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:11.077Z",
            "name": "Analytic 2251",
            "description": "Real-time monitoring identifies Virtual Network Computing (VNC) or proprietary remote console sessions to embedded Human-Machine Interface (HMI) panels or operator terminals from IP addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, where the sessions access Industrial Control System (ICS) control interfaces with physical-plant impact. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementCIDR",
                    "description": "IP ranges authorized for remote desktop/console access to ICS hosts."
                },
                {
                    "field": "ApprovedOperatorList",
                    "description": "Accounts with documented operator/engineer roles."
                },
                {
                    "field": "ApprovedOperatorWorkstations",
                    "description": "Inventory of workstations from which operator/engineer interactive sessions are expected to originate."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--22252671-e8e9-4853-8696-7a38ec7bad53",
            "created": "2026-10-13T17:46:58.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0793#AN2242",
                    "external_id": "AN2242"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:58.661Z",
            "name": "Analytic 2242",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol messages using embedded device built-in utilities or vendor-supplied diagnostic tools to execute payloads, from sources not in the approved engineering workstation list, containing payloads inconsistent with legitimate diagnostic use. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of ICS hosts warranting this elevated monitoring."
                },
                {
                    "field": "LOLBinAbusePatterns",
                    "description": "Documented command-line argument patterns for living-off-the-land binary abuse."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--23d4c3a3-a195-4d5f-a5c5-ae4d23054ee4",
            "created": "2026-10-13T17:47:40.158Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0736#AN2271",
                    "external_id": "AN2271"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:40.158Z",
            "name": "Analytic 2271",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) vendor process making outbound connections on commonly-allowed port (e.g., 80, 443, 8080, etc.) to a destination not in the approved vendor domain list, from a host whose documented role does not require external connectivity. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 on port 80/443/8080 from process not matching Industrial Control Systems (ICS) vendor update process allowlist"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor domains for software updates, licensing, or remote support."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose documented function never requires outbound internet connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--27e8a172-0682-4d23-a7c2-e2eac526ea9c",
            "created": "2026-10-13T17:46:46.388Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0765#AN2230",
                    "external_id": "AN2230"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:46.388Z",
            "name": "Analytic 2230",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol restart command directed at a field device from a source not in the approved engineering workstation list, where multiple devices receive restart commands within a short window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedServiceAdmins",
                    "description": "Accounts authorized to stop/start critical ICS services."
                },
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "CriticalICSServiceList",
                    "description": "List of Windows services whose stoppage constitutes a high-impact event."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2862e391-b78a-400f-819e-d44e672e3d3a",
            "created": "2026-10-13T17:46:01.858Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0771#AN2196",
                    "external_id": "AN2196"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:01.858Z",
            "name": "Analytic 2196",
            "description": "Real-time monitoring identifies network device credential changes such as Authentication, Authorization, and Accounting (AAA) password modification or Simple Network Management Protocol (SNMP) community string modification from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, corroborated by syslog showing authentication failures from legitimate NMS systems following the change. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedCredentialAdmins",
                    "description": "Accounts authorized to change credentials for ICS service and operator accounts."
                },
                {
                    "field": "CredentialChangeImpactWindow",
                    "description": "Time window after a credential change within which a service authentication failure is considered directly connected."
                },
                {
                    "field": "CredentialRotationSchedule",
                    "description": "Documented schedule for routine credential rotation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2a89e23c-fb19-456c-bf77-db29bc673301",
            "created": "2026-10-13T17:46:05.565Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0797#AN2200",
                    "external_id": "AN2200"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:05.565Z",
            "name": "Analytic 2200",
            "description": "Real-time monitoring identifies configuration changes to serial server or terminal server devices that alter serial port parameters for ports connected to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SerialBlockCorrelationWindow",
                    "description": "Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2b726f82-bb4f-4889-b6a0-4587f438cd83",
            "created": "2026-10-13T17:45:19.389Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0910#AN2164",
                    "external_id": "AN2164"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:19.389Z",
            "name": "Analytic 2164",
            "description": "Real-time monitoring identifies iptables/nftables rule additions blocking Industrial Control System (ICS) protocol ports on Linux ICS gateways. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for network infrastructure configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which connectivity-affecting changes are authorized."
                },
                {
                    "field": "CommBlockCorrelationWindow",
                    "description": "Time window correlating a configuration change with subsequent communication loss."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2c7a6c0b-55f7-44d1-a605-bf2dd1dee01a",
            "created": "2026-10-13T17:44:23.746Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0723#AN2121",
                    "external_id": "AN2121"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:23.746Z",
            "name": "Analytic 2121",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "syslog:daemon",
                    "channel": "Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CPUUtilizationThreshold",
                    "description": "Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."
                },
                {
                    "field": "DoSConnectionThreshold",
                    "description": "Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."
                },
                {
                    "field": "DoSDetectionWindow",
                    "description": "Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."
                },
                {
                    "field": "ExpectedPollInterval",
                    "description": "Device-specific supervisory poll interval used to determine what counts as a process historian gap."
                },
                {
                    "field": "InterfaceErrorThreshold",
                    "description": "Deviation from baseline interface error/discard rate, tuned against historical interface health data."
                },
                {
                    "field": "MalformedPacketThreshold",
                    "description": "Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--2d784f76-a3e0-46ed-8ce2-d9dcd531fa52",
            "created": "2026-10-13T17:47:01.490Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0749#AN2244",
                    "external_id": "AN2244"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:01.490Z",
            "name": "Analytic 2244",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices -- function code sequences retrieving entire data dictionaries rather than operational process values -- from a source with no prior history of configuration-read sessions. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "bulk read of configuration/data dictionary objects from source with no prior session history with this device"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to perform legitimate bulk reads of ICS data."
                },
                {
                    "field": "BulkAccessThreshold",
                    "description": "Number of distinct files read within the detection window that constitutes bulk collection."
                },
                {
                    "field": "ICSDataPaths",
                    "description": "File system paths containing ICS configuration, project, and sensitive operational data."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--301b9d5c-6bcd-4539-9ace-6ae4c5d94c43",
            "created": "2026-10-13T17:45:44.208Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0804#AN2180",
                    "external_id": "AN2180"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:44.208Z",
            "name": "Analytic 2180",
            "description": "Real-time monitoring identifies new east-west connections between Industrial Control System (ICS) hosts on remote service ports not in the approved communication matrix. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Comprehensive matrix of expected inter-host communication on remote service ports."
                },
                {
                    "field": "ApprovedLateralMovementPairs",
                    "description": "Documented, approved host-to-host remote access pairs within the ICS network."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4",
            "created": "2026-10-13T17:45:06.815Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0795#AN2154",
                    "external_id": "AN2154"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:06.815Z",
            "name": "Analytic 2154",
            "description": "Real-time monitoring identifies ptrace syscalls or /proc/pid/mem write operations targeting Industrial Control System (ICS) service processes from a process that is not a debugger or vendor diagnostic tool. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=ptrace/process_vm_readv; process accesses an ICS service process PID from an image or UID not in the debugger/diagnostic allowlist"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window correlating a memory access event with a subsequent crash."
                },
                {
                    "field": "TrustedSecurityToolList",
                    "description": "Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--346fbf4f-5fc5-4acb-9d2f-cd30c3c22226",
            "created": "2026-10-13T17:44:44.076Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0749#AN2137",
                    "external_id": "AN2137"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:44.076Z",
            "name": "Analytic 2137",
            "description": "Real-time monitoring identifies a Linux process performing sequential reads across multiple ICS configuration or data paths by a UID outside approved backup, engineering, or vendor-application accounts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to perform legitimate bulk reads of ICS data."
                },
                {
                    "field": "BulkAccessThreshold",
                    "description": "Number of distinct files read within the detection window that constitutes bulk collection."
                },
                {
                    "field": "ICSDataPaths",
                    "description": "File system paths containing ICS configuration, project, and sensitive operational data."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--35b0fba9-70c7-420b-a9eb-b3caf6b9d87e",
            "created": "2026-10-13T17:44:58.977Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0787#AN2148",
                    "external_id": "AN2148"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:58.977Z",
            "name": "Analytic 2148",
            "description": "Real-time monitoring identifies an account on an ICS Linux host invoking SSH, SNMP, or another remote-management utility with a non-local target to query remote system identity, hardware, operating-system, or inventory information outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for device identification queries."
                },
                {
                    "field": "ApprovedSystemAdmins",
                    "description": "Accounts with documented system administration responsibilities."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--35c7f7bd-a79b-4125-ba0c-2bbf281ebf51",
            "created": "2026-10-13T17:44:50.784Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0770#AN2142",
                    "external_id": "AN2142"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:50.784Z",
            "name": "Analytic 2142",
            "description": "Real-time monitoring identifies execution of network enumeration tools (ss, netstat, arp, ip neigh) on an Industrial Control System (ICS) Linux asset from a User Identifier (UID) that does not normally perform network administration. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAdmins",
                    "description": "Accounts with documented network administration responsibilities."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for topology queries."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic mapping sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--392fc0ea-dcf5-40cd-81ce-df2a9b90f8cc",
            "created": "2026-10-13T17:46:22.357Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0794#AN2212",
                    "external_id": "AN2212"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:22.357Z",
            "name": "Analytic 2212",
            "description": "Real-time monitoring identifies a control/command message arriving at a field device from a source not in the approved control server list, where the command targets safety-critical output points and does not correspond to any scheduled or operator-acknowledged process action. Documented precedent: Industroyer2 connected directly to specific International Electrotechnical Commission (IEC)-104 RTUs and toggled hardcoded Information Object Addresses (IOAs) to OFF using command type 46, targeting circuit breaker outputs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "process state change recorded without preceding operator_ack or scheduled switching order reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "multiple safety-critical outputs toggle within rapid toggle window, pattern consistent with scripted issuance"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate control sources."
                },
                {
                    "field": "RapidToggleWindow",
                    "description": "Time window within which multiple safety-critical output changes are considered a coordinated event."
                },
                {
                    "field": "SafetyCriticalOutputAddresses",
                    "description": "Documented register/IOA addresses corresponding to safety-critical outputs per device."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--39fb5809-408b-4f42-a26f-92d372d1a041",
            "created": "2026-10-13T17:45:42.325Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0802#AN2179",
                    "external_id": "AN2179"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:42.325Z",
            "name": "Analytic 2179",
            "description": "Real-time monitoring identifies transfer protocol traffic such as the Trivial File Transfer Protocol (TFTP) or vendor-specific protocol traffic initiating firmware-update mode on Industrial Control System (ICS) device Internet Protocol (IP) addresses from sources not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmSilenceGracePeriod",
                    "description": "Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update mode activation."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware update mode activation is authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to activate firmware update mode."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware update activities are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3a8c6bca-bc2c-4a70-9446-8b2adca39441",
            "created": "2026-10-13T17:48:02.706Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0909#AN2285",
                    "external_id": "AN2285"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:02.706Z",
            "name": "Analytic 2285",
            "description": "Real-time monitoring identifies a Windows process joining Industrial Control System (ICS) multicast groups from a process not associated with an approved ICS protection relay monitoring tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized to subscribe to ICS multicast groups."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--3fdeb2a5-e60c-4fac-b003-528676da2f05",
            "created": "2026-10-13T17:44:51.977Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0771#AN2143",
                    "external_id": "AN2143"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:51.977Z",
            "name": "Analytic 2143",
            "description": "Real-time monitoring identifies passwd/chpasswd modification of Industrial Control System (ICS) service account credentials by a User Identifier (UID) that is not a designated system administrator, outside a formal credential rotation procedure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedCredentialAdmins",
                    "description": "Accounts authorized to change credentials for ICS service and operator accounts."
                },
                {
                    "field": "CredentialChangeImpactWindow",
                    "description": "Time window after a credential change within which a service authentication failure is considered directly connected."
                },
                {
                    "field": "CredentialRotationSchedule",
                    "description": "Documented schedule for routine credential rotation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4053f72d-59c0-432e-a969-83217c586338",
            "created": "2026-10-13T17:47:04.076Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0754#AN2247",
                    "external_id": "AN2247"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:04.076Z",
            "name": "Analytic 2247",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices, covering address ranges never queried by legitimate Supervisory Control and Data Acquisition (SCADA), suggesting systematic extraction of ICS design documentation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "bulk configuration/program object read from source with no prior configuration-read session history"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "AuthorizedEngineerAccounts",
                    "description": "Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories."
                },
                {
                    "field": "BulkDocumentAccessThreshold",
                    "description": "File count threshold distinguishing bulk reconnaissance from routine reference lookups."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Row count threshold for historian queries considered bulk export."
                },
                {
                    "field": "InformationRepositoryTimeWindow",
                    "description": "Time window within which sequential file accesses are considered part of a single bulk collection event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4062a3b7-6859-4b28-b0d3-b0f71dc62f6a",
            "created": "2026-10-13T17:47:07.448Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0787#AN2249",
                    "external_id": "AN2249"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:07.448Z",
            "name": "Analytic 2249",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol requests targeting device identification and system metadata objects from a source not in the approved control server list, specifically aimed at device metadata rather than process values. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for device identification queries."
                },
                {
                    "field": "ApprovedSystemAdmins",
                    "description": "Accounts with documented system administration responsibilities."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--45c339b2-55b1-4a8b-b21d-c53c3bf2b73a",
            "created": "2026-10-13T17:46:32.676Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0756#AN2218",
                    "external_id": "AN2218"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:32.676Z",
            "name": "Analytic 2218",
            "description": "Real-time monitoring identifies successful authentication to a field device using credentials matching documented vendor-default values, from a source not in the approved access list. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "authentication success using credential matching default vendor credential list from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--46022e9c-fcb9-4369-b953-ad5724a6819b",
            "created": "2026-10-13T17:45:11.655Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0802#AN2158",
                    "external_id": "AN2158"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:11.655Z",
            "name": "Analytic 2158",
            "description": "Real-time monitoring identifies a firmware update tool on an Industrial Control System (ICS) Linux engineering host initiating firmware-update mode activation outside a scheduled maintenance window, by a User Identifier (UID) not in the approved firmware manager UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmSilenceGracePeriod",
                    "description": "Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update mode activation."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware update mode activation is authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to activate firmware update mode."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware update activities are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--46604667-aba2-403a-b41b-6e5a9f1494da",
            "created": "2026-10-13T17:44:14.649Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0764#AN2115",
                    "external_id": "AN2115"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:14.649Z",
            "name": "Analytic 2115",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset with both a listening socket on an ICS protocol port and an outbound connection to a non-ICS destination, combined with iptables DNAT rules redirecting ICS protocol port traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AiTMCorrelationWindow",
                    "description": "Time window within which a MAC binding change and protocol baseline deviation are considered correlated."
                },
                {
                    "field": "ExpectedNextHopBaseline",
                    "description": "Documented expected network path for device subnet traffic."
                },
                {
                    "field": "TopologyChangeTicket",
                    "description": "Change-management reference confirming an authorized hardware replacement or topology modification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--47aafd6b-75d1-44e9-b2bc-505d9fbb4671",
            "created": "2026-10-13T17:44:27.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0726#AN2124",
                    "external_id": "AN2124"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:27.280Z",
            "name": "Analytic 2124",
            "description": "Real-time monitoring identifies a process executing iwconfig or ip link set <wlan> promisc, or loading mac80211 monitor mode, on an Industrial Control System (ICS) Linux asset outside normal configuration management activity. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless monitor mode for diagnostics."
                },
                {
                    "field": "WirelessOnboardWindow",
                    "description": "Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--482edcb0-46cd-45b6-a373-2e9bbe2ffad2",
            "created": "2026-10-13T17:47:02.412Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0750#AN2245",
                    "external_id": "AN2245"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:02.412Z",
            "name": "Analytic 2245",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) field device event logs being cleared via ICS protocol commands from a source not in the approved engineering workstation list, occurring immediately following other suspicious ICS activity on the same device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedLogManagementTools",
                    "description": "Allowlist of processes/accounts authorized to delete or truncate ICS application logs."
                },
                {
                    "field": "LogClearLookbackWindow",
                    "description": "Time window prior to a log-clear event within which other suspicious activity is considered correlated."
                },
                {
                    "field": "ScheduledLogRotationWindow",
                    "description": "Documented schedule for legitimate, automated log rotation/archival."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4984e65d-1bb6-4de1-8dfc-5672e822bb47",
            "created": "2026-10-13T17:47:45.412Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0759#AN2275",
                    "external_id": "AN2275"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:45.412Z",
            "name": "Analytic 2275",
            "description": "Real-time monitoring identifies a Windows process holding simultaneous connections to both the field device subnet and an external destination, combined with proxy-tool process creation. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7045 enabling Transmission Control Protocol (TCP) port forwarding on Industrial Control Systems (ICS) protocol port not in known ICS services"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "RelayCorrelationWindow",
                    "description": "Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--49d64aa5-8804-45c9-99d9-b0729f3dc58c",
            "created": "2026-10-13T17:46:13.532Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0737#AN2207",
                    "external_id": "AN2207"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:13.532Z",
            "name": "Analytic 2207",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Windows application such as a Supervisory Control and Data Acquisition (SCADA) server or Distributed Control System (DCS) interface generating anomalously high-frequency write Application Programming Interface (API) calls to field devices, exceeding the configured scan rate baseline for that point. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BruteForceDetectionWindow",
                    "description": "Time window over which write rate is measured for threshold comparison."
                },
                {
                    "field": "MaxNormalStateChangeRate",
                    "description": "Maximum rate at which the physical process value is expected to legitimately change state."
                },
                {
                    "field": "MaxWriteQueueDepth",
                    "description": "Maximum legitimate write queue depth for SCADA/DCS write operations to a single point."
                },
                {
                    "field": "MaxWriteRatePerPoint",
                    "description": "Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--49d68949-cdc8-4364-9700-7786f4d08871",
            "created": "2026-10-13T17:46:11.116Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0912#AN2205",
                    "external_id": "AN2205"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:11.116Z",
            "name": "Analytic 2205",
            "description": "Real-time monitoring identifies a mass deauthentication event targeting multiple enrolled Industrial Control System (ICS) wireless devices simultaneously, or a wireless access point configuration change excluding enrolled device Media Access Control (MAC) address from the association list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessAdminList",
                    "description": "Accounts/sources authorized to modify wireless infrastructure configuration."
                },
                {
                    "field": "DeauthTimeWindow",
                    "description": "Time window within which multiple deauthentication events are considered a coordinated mass event."
                },
                {
                    "field": "MassDeauthThreshold",
                    "description": "Number of simultaneously deauthenticated enrolled devices that constitutes a mass event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4a1b6793-4389-40f7-a7d3-8ad98cba738e",
            "created": "2026-10-13T17:46:52.508Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0759#AN2237",
                    "external_id": "AN2237"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:52.508Z",
            "name": "Analytic 2237",
            "description": "Real-time monitoring identifies a field device or serial gateway receiving Industrial Control System (ICS) protocol traffic relayed through an intermediate host, identifiable by protocol-level timing anomalies or L2 source address changes where the device Internet Protocol (IP) address responds from a Media Access Control (MAC) address different from its enrolled hardware address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "RelayCorrelationWindow",
                    "description": "Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4be2c353-ef8d-4bb4-b973-4cae602f627f",
            "created": "2026-10-13T17:44:34.793Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0737#AN2130",
                    "external_id": "AN2130"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:34.793Z",
            "name": "Analytic 2130",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Linux service process making write Application Programming Interface (API) calls to field device Input/Output (I/O) at a rate exceeding the configured scan rate, from a User Identifier (UID) associated with the Supervisory Control and Data Acquisition (SCADA)/control application but exhibiting anomalous write volume. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BruteForceDetectionWindow",
                    "description": "Time window over which write rate is measured for threshold comparison."
                },
                {
                    "field": "MaxNormalStateChangeRate",
                    "description": "Maximum rate at which the physical process value is expected to legitimately change state."
                },
                {
                    "field": "MaxWriteQueueDepth",
                    "description": "Maximum legitimate write queue depth for SCADA/DCS write operations to a single point."
                },
                {
                    "field": "MaxWriteRatePerPoint",
                    "description": "Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4ea5942d-fa95-484d-9acb-fe205a3960a3",
            "created": "2026-10-13T17:46:43.463Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0910#AN2227",
                    "external_id": "AN2227"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:43.463Z",
            "name": "Analytic 2227",
            "description": "Real-time monitoring identifies multiple field devices becoming unreachable simultaneously following a network infrastructure configuration change event. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for network infrastructure configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which connectivity-affecting changes are authorized."
                },
                {
                    "field": "CommBlockCorrelationWindow",
                    "description": "Time window correlating a configuration change with subsequent communication loss."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--4effd386-490e-435b-9375-f53a3b44f0d0",
            "created": "2026-10-13T17:46:48.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0770#AN2232",
                    "external_id": "AN2232"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:48.044Z",
            "name": "Analytic 2232",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol messages querying network topology information from embedded devices -- neighbor device lists, Common Industrial Protocol (CIP) port object information -- from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAdmins",
                    "description": "Accounts with documented network administration responsibilities."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for topology queries."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic mapping sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--500aec57-cf41-4572-bdae-f08e185ebeec",
            "created": "2026-10-13T17:46:51.696Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0746#AN2236",
                    "external_id": "AN2236"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:51.696Z",
            "name": "Analytic 2236",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) unsolicited response messages such as Distributed Network Protocol 3 (DNP3) unsolicited or Generic Object Oriented Substation Event (GOOSE) frames arriving from Internet Protocol (IP) or Media Access Control (MAC) addresses that do not match the enrolled device for those data points. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "unsolicited response message source identity does not match the enrolled device for those data points"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SensorToleranceThreshold",
                    "description": "Acceptable divergence between primary and independent secondary measurement of the same physical quantity."
                },
                {
                    "field": "ZeroVarianceWindow",
                    "description": "Time window over which reported values are checked for implausible stability."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--518d0e1a-b5e2-4c12-a36c-8d61ad58955e",
            "created": "2026-10-13T17:47:16.047Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0796#AN2256",
                    "external_id": "AN2256"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:16.047Z",
            "name": "Analytic 2256",
            "description": "Real-time monitoring identifies Secure Shell (SSH), web application, or Industrial Control System (ICS) Application Programming Interface (API) authentication attempts on ICS Linux servers from internet-sourced Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "syslog:auth",
                    "channel": "authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "OrganizationalIPSpace",
                    "description": "Documented internal/organizational IP address ranges."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--51c17c6d-d4f7-46f6-840e-3697b33d2783",
            "created": "2026-10-13T17:47:55.679Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0797#AN2280",
                    "external_id": "AN2280"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:55.679Z",
            "name": "Analytic 2280",
            "description": "Real-time monitoring identifies Windows serial port configuration changes on Industrial Control System (ICS) gateway hosts that would disrupt communication with serial field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--da85d358-741a-410d-9433-20d6269a6170",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=13 to Communication (COM) port configuration key by process not in authorized serial port management tools"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SerialBlockCorrelationWindow",
                    "description": "Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5330f4ab-a6f0-411d-957d-bb7bd2a73ddf",
            "created": "2026-10-13T17:46:36.923Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0736#AN2221",
                    "external_id": "AN2221"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:36.923Z",
            "name": "Analytic 2221",
            "description": "Real-time monitoring identifies an embedded field device initiating outbound connections on a commonly-used port to a destination outside the device's documented operational communication profile, which for most embedded Industrial Control System (ICS) devices normally should not include arbitrary outbound internet connectivity under the approved communications architecture. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "embedded device_ip initiates outbound connection on port 443/80/8080 to destination outside documented operational profile"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor domains for software updates, licensing, or remote support."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose documented function never requires outbound internet connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5346fb44-b04e-4820-8b14-eb62ee3a2ca8",
            "created": "2026-10-13T17:46:01.007Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0765#AN2195",
                    "external_id": "AN2195"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:01.007Z",
            "name": "Analytic 2195",
            "description": "Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to service-stop Object Identifiers (OIDs) or Command Line Interface (CLI) commands stopping routing/switching processes critical to Industrial Control System (ICS) communication, from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedServiceAdmins",
                    "description": "Accounts authorized to stop/start critical ICS services."
                },
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "CriticalICSServiceList",
                    "description": "List of Windows services whose stoppage constitutes a high-impact event."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5ac739da-7adb-491a-8ef9-694846572fc1",
            "created": "2026-10-13T17:46:38.571Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0796#AN2222",
                    "external_id": "AN2222"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:38.571Z",
            "name": "Analytic 2222",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "OrganizationalIPSpace",
                    "description": "Documented internal/organizational IP address ranges."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5b7ee346-9061-4e8e-9bec-4d629cf488c5",
            "created": "2026-10-13T17:48:05.156Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0722#AN2286",
                    "external_id": "AN2286"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:05.156Z",
            "name": "Analytic 2286",
            "description": "Real-time monitoring identifies ICS protocol responses whose timing or payload structure deviates from the established device-specific per-function baseline in a pattern consistent with an intercepting relay or hook. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "otids:ProtocolDecoder",
                    "channel": "Protocol decoder/IDS transaction: traffic on an ICS service port fails expected protocol parsing/conformance or decodes as a different application protocol"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedICSVendorProcessList",
                    "description": "Allowlist of processes permitted to install window/event hooks on ICS engineering and HMI hosts."
                },
                {
                    "field": "ICSServiceBinaryList",
                    "description": "List of binary paths for ICS gateway, OPC, and historian services on Linux assets that should never be launched with LD_PRELOAD set."
                },
                {
                    "field": "VendorPackageManifest",
                    "description": "Package manager manifest cross-reference confirming a shared library belongs to an installed, signed package."
                },
                {
                    "field": "VendorSignedDLLHashBaseline",
                    "description": "Cryptographic hash inventory of all vendor-signed ICS communication DLLs, refreshed on every legitimate vendor patch cycle."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5cf9cf41-4419-4d04-afcd-991dff638faf",
            "created": "2026-10-13T17:44:12.730Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0754#AN2114",
                    "external_id": "AN2114"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:12.730Z",
            "name": "Analytic 2114",
            "description": "Real-time monitoring identifies bulk file access on a Linux-hosted Industrial Control System (ICS) documentation repository (piping and instrumentation diagram stores, configuration archives) by a User Identifier (UID) not associated with documented engineering roles. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "AuthorizedEngineerAccounts",
                    "description": "Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories."
                },
                {
                    "field": "BulkDocumentAccessThreshold",
                    "description": "File count threshold distinguishing bulk reconnaissance from routine reference lookups."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Row count threshold for historian queries considered bulk export."
                },
                {
                    "field": "InformationRepositoryTimeWindow",
                    "description": "Time window within which sequential file accesses are considered part of a single bulk collection event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5db2235a-aa06-47b7-a89e-953a5afb6555",
            "created": "2026-10-13T17:45:10.431Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0801#AN2157",
                    "external_id": "AN2157"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:10.431Z",
            "name": "Analytic 2157",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Linux engineering tool issuing device restart commands outside a scheduled maintenance window, from a User Identifier (UID) not in the approved engineer list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which restarts are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--5f4e48bc-ac0a-4a86-8d59-229105b212ca",
            "created": "2026-10-13T17:46:49.771Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0909#AN2234",
                    "external_id": "AN2234"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:49.771Z",
            "name": "Analytic 2234",
            "description": "Real-time monitoring identifies a new Internet Group Management Protocol (IGMP) group join or multicast subscription from a source Media Access Control (MAC)/Internet Protocol (IP) not in the approved device inventory, particularly for protection-relay Generic Object Oriented Substation Event (GOOSE) datasets. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized to subscribe to ICS multicast groups."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--61dac9fe-69e8-40df-b573-e1eebff4cfc1",
            "created": "2026-10-13T17:44:37.170Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0739#AN2132",
                    "external_id": "AN2132"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:37.170Z",
            "name": "Analytic 2132",
            "description": "Real-time monitoring identifies execution of network discovery tools on an Industrial Control System (ICS) Linux asset by a User Identifier (UID) that does not normally perform network scanning. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate engineering and SCADA systems."
                },
                {
                    "field": "AuthorizedNetworkTools",
                    "description": "Allowlist of network management/diagnostic tools authorized for use on ICS hosts."
                },
                {
                    "field": "DiscoveryTimeWindow",
                    "description": "Time window within which sequential connections across the address range are considered a single discovery sweep event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--62dee878-27af-4620-b710-10b0ca373701",
            "created": "2026-10-13T17:43:58.772Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0728#AN2108",
                    "external_id": "AN2108"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:58.772Z",
            "name": "Analytic 2108",
            "description": "Real-time monitoring identifies a write to alarm configuration files or database tables on an Human-Machine Interface (HMI)/alarm server by a process other than the recognized alarm management application, or an alarm-class-disable Application Programming Interface (API) call logged without a corresponding operator session ID in the HMI audit trail. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "alarmserver:ApplicationLog",
                    "channel": "alarm class disabled or suppressed Application Programming Interface (API) event logged without operator_id field populated"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmConfigAddressRange",
                    "description": "Protocol register/address ranges corresponding to alarm threshold and configuration values per device type."
                },
                {
                    "field": "AlarmConfigPaths",
                    "description": "File system paths for alarm configuration files/databases on Windows alarm servers."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to ICS devices, including alarm configuration."
                },
                {
                    "field": "HMIAlarmParentAllowlist",
                    "description": "Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration."
                },
                {
                    "field": "SuppressGracePeriod",
                    "description": "Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--62ef9334-2cb2-436d-bd50-2ae1213704aa",
            "created": "2026-10-13T17:44:48.471Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0765#AN2140",
                    "external_id": "AN2140"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:48.471Z",
            "name": "Analytic 2140",
            "description": "Real-time monitoring identifies systemctl stop or kill commands targeting Industrial Control System (ICS) service processes on Linux assets, from a User Identifier (UID) that is not the ICS service owner or an authorized system administrator. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedServiceAdmins",
                    "description": "Accounts authorized to stop/start critical ICS services."
                },
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "CriticalICSServiceList",
                    "description": "List of Windows services whose stoppage constitutes a high-impact event."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--62facfaa-0d19-4479-8cd7-cfef4c30898c",
            "created": "2026-10-13T17:45:08.047Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0799#AN2155",
                    "external_id": "AN2155"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:08.047Z",
            "name": "Analytic 2155",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) Linux service processes initiating outbound application-layer protocol connections to ports/destinations outside the approved communication matrix. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor/business domains for application-layer protocol traffic."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose role does not require external application-layer connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6549a8ab-c92c-4249-a5f2-cd9d0458192d",
            "created": "2026-10-13T17:45:57.863Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0750#AN2192",
                    "external_id": "AN2192"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:57.863Z",
            "name": "Analytic 2192",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) network device syslog showing a gap in expected event sequence numbers, or syslog forwarding interruption from a device coinciding with a period of suspicious activity on that device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedLogManagementTools",
                    "description": "Allowlist of processes/accounts authorized to delete or truncate ICS application logs."
                },
                {
                    "field": "LogClearLookbackWindow",
                    "description": "Time window prior to a log-clear event within which other suspicious activity is considered correlated."
                },
                {
                    "field": "ScheduledLogRotationWindow",
                    "description": "Documented schedule for legitimate, automated log rotation/archival."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6623745b-ae70-491c-a317-8206b4789463",
            "created": "2026-10-13T17:46:41.801Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0804#AN2225",
                    "external_id": "AN2225"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:41.801Z",
            "name": "Analytic 2225",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol traffic originating from one field device Internet Protocol (IP) address to another field device, a pattern not consistent with the documented device-to-supervisory communication topology. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationMatrix",
                    "description": "Comprehensive matrix of expected inter-host communication on remote service ports."
                },
                {
                    "field": "ApprovedLateralMovementPairs",
                    "description": "Documented, approved host-to-host remote access pairs within the ICS network."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--66c22dd3-7665-4ead-ab01-5a4742c37d8b",
            "created": "2026-10-13T17:47:03.248Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0753#AN2246",
                    "external_id": "AN2246"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:03.248Z",
            "name": "Analytic 2246",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) protocol messages using vendor-specific or undocumented function codes that access device hardware registers directly rather than through the normal ICS application layer, from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to interact with ICS hardware/protocols."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6829c203-6543-4489-bab8-422a41ac82a1",
            "created": "2026-10-13T17:45:32.900Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0731#AN2170",
                    "external_id": "AN2170"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:32.900Z",
            "name": "Analytic 2170",
            "description": "Real-time monitoring identifies vendor-specific firmware-update protocol traffic to ICS device IP addresses from a source not in the approved engineering-workstation or firmware-management baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Trivial File Transfer Protocol (TFTP) session to device Internet Protocol (IP) address from source not in engineering workstation list followed by device reboot syslog within firmware transfer window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFirmwareInventory",
                    "description": "Cryptographic hash inventory of authorized firmware versions per device model."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update operations."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform firmware updates."
                },
                {
                    "field": "FirmwareSessionSizeThreshold",
                    "description": "Minimum byte count for a session to be considered a firmware transfer rather than routine configuration traffic, derived from known firmware image sizes."
                },
                {
                    "field": "FirmwareUpdateWindow",
                    "description": "Time window within which a device reboot following a large session is considered part of the same firmware update event."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware updates are expected to occur."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--684fc82e-39d7-48c8-9123-5badd99afaa7",
            "created": "2026-10-13T17:46:47.205Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0725#AN2231",
                    "external_id": "AN2231"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:47.205Z",
            "name": "Analytic 2231",
            "description": "Real-time monitoring identifies an ICS device presenting protocol identity attributes (for example vendor, product, model, or capability identifiers) that conflict with the identity and capabilities recorded for that network address/device in the authorized asset inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AssetInventoryDeviceTypes",
                    "description": "Maintained inventory of expected vendor/product identity strings per enrolled device IP."
                },
                {
                    "field": "ICSDaemonNames",
                    "description": "List of expected Linux ICS service daemon process names."
                },
                {
                    "field": "ICSVendorProcessNames",
                    "description": "List of known ICS vendor executable names used as the masquerade-target watchlist."
                },
                {
                    "field": "VendorHashBaseline",
                    "description": "Cryptographic hash inventory for all legitimate versions of vendor ICS binaries, updated on every patch cycle."
                },
                {
                    "field": "VendorInstallPaths",
                    "description": "Authorized installation directories for each ICS vendor application."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--695ad38a-7e5b-4d91-bab3-2388d3ae2f0b",
            "created": "2026-10-13T17:45:34.059Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0739#AN2171",
                    "external_id": "AN2171"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:34.059Z",
            "name": "Analytic 2171",
            "description": "Real-time network monitoring identifies a source generating Industrial Control System (ICS) discovery broadcasts or sequential connection attempts across the full IP range of a device subnet, from a source not in the approved engineering/Supervisory Control and Data Acquisition (SCADA) inventory. Documented in the PIPEDREAM/INCONTROLLER toolset's CODECALL module for EtherNet/IP device discovery. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate engineering and SCADA systems."
                },
                {
                    "field": "AuthorizedNetworkTools",
                    "description": "Allowlist of network management/diagnostic tools authorized for use on ICS hosts."
                },
                {
                    "field": "DiscoveryTimeWindow",
                    "description": "Time window within which sequential connections across the address range are considered a single discovery sweep event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6c7a03f0-1697-4109-9b8c-70567ed5eaf4",
            "created": "2026-10-13T17:47:28.536Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0771#AN2262",
                    "external_id": "AN2262"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:28.536Z",
            "name": "Analytic 2262",
            "description": "Real-time monitoring identifies a password change event for an Industrial Control System (ICS) service or operator account performed by an account not in the authorized credential administration role, immediately followed by failed authentication attempts from the Industrial Control System (ICS) service itself. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "WinEventLog:System",
                    "channel": "Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedCredentialAdmins",
                    "description": "Accounts authorized to change credentials for ICS service and operator accounts."
                },
                {
                    "field": "CredentialChangeImpactWindow",
                    "description": "Time window after a credential change within which a service authentication failure is considered directly connected."
                },
                {
                    "field": "CredentialRotationSchedule",
                    "description": "Documented schedule for routine credential rotation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--6e73b9c1-482d-44c7-b25b-e9b99764e987",
            "created": "2026-10-13T17:44:42.860Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0746#AN2136",
                    "external_id": "AN2136"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:42.861Z",
            "name": "Analytic 2136",
            "description": "Real-time monitoring identifies a Linux process generating Industrial Control System (ICS) protocol unsolicited responses or publishing Open Platform Communications Unified Architecture (OPC UA) data changes for device addresses it does not own, from a User Identifier (UID) not associated with the authorized data acquisition service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "decoded ICS protocol unsolicited response or OPC UA data-change message for a device/address not normally owned by the observed source"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SensorToleranceThreshold",
                    "description": "Acceptable divergence between primary and independent secondary measurement of the same physical quantity."
                },
                {
                    "field": "ZeroVarianceWindow",
                    "description": "Time window over which reported values are checked for implausible stability."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--736619f9-f636-4308-843b-83d38813982b",
            "created": "2026-10-13T17:45:50.847Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0787#AN2186",
                    "external_id": "AN2186"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:50.847Z",
            "name": "Analytic 2186",
            "description": "Real-time monitoring identifies Simple Network Management Protocol (SNMP) GET requests targeting system information Object Identifiers (OIDs) from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, directed at Industrial Control System (ICS) server or device IPs. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for device identification queries."
                },
                {
                    "field": "ApprovedSystemAdmins",
                    "description": "Accounts with documented system administration responsibilities."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--74ac7748-3b80-4aac-ad25-c3e6914cb01a",
            "created": "2026-10-13T17:47:11.946Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0912#AN2252",
                    "external_id": "AN2252"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:11.946Z",
            "name": "Analytic 2252",
            "description": "Real-time monitoring identifies deauthentication frames targeting enrolled Industrial Control System (ICS) wireless device Media Access Control (MAC) address from a source not in the approved wireless infrastructure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Content",
                    "channel": "deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessAdminList",
                    "description": "Accounts/sources authorized to modify wireless infrastructure configuration."
                },
                {
                    "field": "DeauthTimeWindow",
                    "description": "Time window within which multiple deauthentication events are considered a coordinated mass event."
                },
                {
                    "field": "MassDeauthThreshold",
                    "description": "Number of simultaneously deauthenticated enrolled devices that constitutes a mass event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--74cb9e26-6ec1-41e8-9da8-ed30504f9c39",
            "created": "2026-10-13T17:46:16.686Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0776#AN2209",
                    "external_id": "AN2209"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:16.686Z",
            "name": "Analytic 2209",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host writing setpoint values to Open Platform Communications (OPC) Data Access (DA)/Unified Architecture (UA) tags or historian writable tags without being the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, with values falling outside the normal operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to parameter/setpoint registers."
                },
                {
                    "field": "BaselineValueRange",
                    "description": "Documented safe operating range for each monitored parameter."
                },
                {
                    "field": "ParameterDriftThreshold",
                    "description": "Percentage deviation from rolling baseline considered significant drift."
                },
                {
                    "field": "SetpointAddressRange",
                    "description": "Register/address ranges corresponding to parameter and setpoint values for the device type."
                },
                {
                    "field": "TimeWindow",
                    "description": "Time window over which post-write drift is measured."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--74e60460-7618-4a7c-b490-c1e164784564",
            "created": "2026-10-13T17:47:17.766Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0905#AN2258",
                    "external_id": "AN2258"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:17.766Z",
            "name": "Analytic 2258",
            "description": "Real-time monitoring identifies successful SSH or application authentication using credentials matching known default or hardcoded vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "syslog:auth",
                    "channel": "sshd Accepted for username matching default or hardcoded credential patterns from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                },
                {
                    "field": "KnownHardcodedCredentialPatterns",
                    "description": "Documented hardcoded credential values for in-use ICS products."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--76f95bb8-16c3-42f7-99a0-929e6f08a24e",
            "created": "2026-10-13T17:47:58.200Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0802#AN2282",
                    "external_id": "AN2282"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:58.200Z",
            "name": "Analytic 2282",
            "description": "Real-time monitoring identifies a vendor firmware update tool activating firmware-update mode on a field device from a Windows host, outside a scheduled maintenance window or by an account not in the approved firmware management role. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmSilenceGracePeriod",
                    "description": "Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update mode activation."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware update mode activation is authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to activate firmware update mode."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware update activities are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--792af2a0-7fc2-4b63-899e-ae09dea3aef1",
            "created": "2026-10-13T17:44:20.394Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0797#AN2119",
                    "external_id": "AN2119"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:20.394Z",
            "name": "Analytic 2119",
            "description": "Real-time monitoring identifies writes to serial device configuration files or `stty` commands changing serial port parameters on Industrial Control System (ICS) Linux gateway hosts from a User Identifier (UID) not associated with authorized serial port management. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SerialBlockCorrelationWindow",
                    "description": "Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--795181c0-57b0-4c2f-ac9a-1c6a1c62b813",
            "created": "2026-10-13T17:46:06.366Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0800#AN2201",
                    "external_id": "AN2201"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:06.366Z",
            "name": "Analytic 2201",
            "description": "Real-time monitoring identifies a new device on the Industrial Control System (ICS) network placing its Network Interface Card (NIC) in promiscuous mode, detectable by anomalous broadcast traffic handling or unauthorized Switched Port Analyzer (SPAN) session requests on managed switches. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAnalysts",
                    "description": "Accounts with documented network analysis/diagnostic responsibilities."
                },
                {
                    "field": "AuthorizedCaptureSoftware",
                    "description": "Allowlist of approved packet capture tools and processes that legitimately load capture drivers."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7b5121f9-506c-40bf-81b2-df1042aa48b7",
            "created": "2026-10-13T17:46:53.325Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0764#AN2238",
                    "external_id": "AN2238"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:53.325Z",
            "name": "Analytic 2238",
            "description": "Real-time network monitoring identifies a field device's source Media Access Control (MAC) address changing without a corresponding documented hardware replacement, combined with protocol-level anomalies (transaction identifier reuse, function-code patterns deviating from baseline) for traffic associated with that device Internet Protocol (IP) address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Content",
                    "channel": "device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AiTMCorrelationWindow",
                    "description": "Time window within which a MAC binding change and protocol baseline deviation are considered correlated."
                },
                {
                    "field": "ExpectedNextHopBaseline",
                    "description": "Documented expected network path for device subnet traffic."
                },
                {
                    "field": "TopologyChangeTicket",
                    "description": "Change-management reference confirming an authorized hardware replacement or topology modification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7d81a83b-ae31-4ceb-b469-bb8a914a751c",
            "created": "2026-10-13T17:45:58.659Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0756#AN2193",
                    "external_id": "AN2193"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:58.659Z",
            "name": "Analytic 2193",
            "description": "Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using well-known default vendor credentials from source Internet Protocol (IP) addresses not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet range. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "networkdevice:syslog",
                    "channel": "Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7d922eff-22d6-4ac2-90d9-3539e0c998fe",
            "created": "2026-10-13T17:47:39.319Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0734#AN2270",
                    "external_id": "AN2270"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:39.319Z",
            "name": "Analytic 2270",
            "description": "Real-time monitoring identifies a host process making sequential Industrial Control System (ICS) protocol reads with output piped to a local staging file, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/historian servers."
                },
                {
                    "field": "AutoCollectionTimeWindow",
                    "description": "Time window within which sequential reads across multiple devices are considered part of a single automated collection event."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Record count threshold above which a historian query is considered a bulk export rather than a routine query."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7ddbb1f7-feda-4a50-b944-b02bedf653b5",
            "created": "2026-10-13T17:45:18.257Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0909#AN2163",
                    "external_id": "AN2163"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:18.257Z",
            "name": "Analytic 2163",
            "description": "Real-time monitoring identifies a Linux process joining Industrial Control System (ICS) multicast groups via socket() with IP_ADD_MEMBERSHIP, from a User Identifier (UID) not associated with any authorized ICS protection system monitoring application. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized to subscribe to ICS multicast groups."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7e96cc61-f4ca-4546-8631-3ef6fff8ae28",
            "created": "2026-10-13T17:45:21.764Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0912#AN2166",
                    "external_id": "AN2166"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:21.764Z",
            "name": "Analytic 2166",
            "description": "Real-time monitoring identifies hostapd or wireless controller configuration changes on Linux-based access points disabling the Industrial Control System (ICS) wireless Service Set Identifier (SSID), by a User Identifier (UID) not in the authorized wireless admin UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessAdminList",
                    "description": "Accounts/sources authorized to modify wireless infrastructure configuration."
                },
                {
                    "field": "DeauthTimeWindow",
                    "description": "Time window within which multiple deauthentication events are considered a coordinated mass event."
                },
                {
                    "field": "MassDeauthThreshold",
                    "description": "Number of simultaneously deauthenticated enrolled devices that constitutes a mass event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--7f685d48-0d80-4ba4-8473-432c31b21da8",
            "created": "2026-10-13T17:44:47.309Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0758#AN2139",
                    "external_id": "AN2139"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:47.309Z",
            "name": "Analytic 2139",
            "description": "Real-time monitoring identifies rapid, bulk deletion of files across Industrial Control System (ICS) data directories on a Linux asset, by a User Identifier (UID) not associated with documented data retention management, correlated with worm-based propagation indicators consistent with documented Linux wiper malware (Awfulshred, SoloShred). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: rm/shred/dd operations across multiple Industrial Control Systems (ICS) data directories exceeding bulk deletion threshold, by User Identifier (UID) not in authorized data management UIDs"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Secure Shell (SSH)-based propagation pattern (connection to multiple hosts followed by file transfer and execution) within a short window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedDataManagementTools",
                    "description": "Allowlist of backup/archival/retention management tools authorized to perform bulk file operations."
                },
                {
                    "field": "BulkDeletionThreshold",
                    "description": "File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup."
                },
                {
                    "field": "DataDestructionTimeWindow",
                    "description": "Time window over which bulk deletion activity is measured."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue memory erase commands."
                },
                {
                    "field": "WiperCrashWindow",
                    "description": "Time window after bulk deletion within which a system crash is considered part of the same destructive event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--856d21f6-edc1-4e7b-84c5-692a467a2dbe",
            "created": "2026-10-13T17:48:06.012Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0725#AN2287",
                    "external_id": "AN2287"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:06.012Z",
            "name": "Analytic 2287",
            "description": "Real-time monitoring identifies traffic on an Industrial Control System (ICS) protocol port (e.g., 502, 20000, 44818, etc.) with payload content that does not conform to the expected protocol structure for that port, suggesting non-ICS traffic tunneled over ICS port numbers to evade port-based filtering or blend with expected traffic patterns. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "otids:ProtocolDecoder",
                    "channel": "Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AssetInventoryDeviceTypes",
                    "description": "Maintained inventory of expected vendor/product identity strings per enrolled device IP."
                },
                {
                    "field": "ICSDaemonNames",
                    "description": "List of expected Linux ICS service daemon process names."
                },
                {
                    "field": "ICSVendorProcessNames",
                    "description": "List of known ICS vendor executable names used as the masquerade-target watchlist."
                },
                {
                    "field": "VendorHashBaseline",
                    "description": "Cryptographic hash inventory for all legitimate versions of vendor ICS binaries, updated on every patch cycle."
                },
                {
                    "field": "VendorInstallPaths",
                    "description": "Authorized installation directories for each ICS vendor application."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1",
            "created": "2026-10-13T17:47:41.828Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0743#AN2272",
                    "external_id": "AN2272"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:41.828Z",
            "name": "Analytic 2272",
            "description": "Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=6 for wireless capture driver on host not in designated wireless management station list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/identity inventory of all devices authorized on the ICS wireless segment."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless capture for diagnostics."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--86989bf4-0dfc-459e-aa67-86c9c02fcdf9",
            "created": "2026-10-13T17:44:40.273Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0743#AN2134",
                    "external_id": "AN2134"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:40.273Z",
            "name": "Analytic 2134",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset setting a wireless interface to monitor mode via iwconfig or netlink calls, from a User Identifier (UID) not associated with documented wireless diagnostics. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/identity inventory of all devices authorized on the ICS wireless segment."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless capture for diagnostics."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f",
            "created": "2026-10-13T17:47:34.226Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0903#AN2266",
                    "external_id": "AN2266"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:34.226Z",
            "name": "Analytic 2266",
            "description": "Real-time monitoring identifies Windows host-based firewall or network policy changes that selectively block Industrial Control System (ICS) communication traffic types from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change selectively blocking one Industrial Control Systems (ICS) traffic type from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) host without corresponding change ticket"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommunicationGapThreshold",
                    "description": "Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8713afc6-95d2-4064-a047-a9be0cc486dd",
            "created": "2026-10-13T17:45:00.155Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0788#AN2149",
                    "external_id": "AN2149"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:00.155Z",
            "name": "Analytic 2149",
            "description": "Real-time monitoring identifies an Open Platform Communications (OPC) Unified Architecture (UA) client process on a Linux Industrial Control System (ICS) host calling browse/enumerate operations against the full namespace, from a User Identifier (UID) not associated with recognized monitoring tools. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client identities authorized for namespace browsing."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate polling/browsing sources."
                },
                {
                    "field": "NamespaceCoverageThreshold",
                    "description": "Percentage of total device tag/object space accessed within a session constituting full enumeration."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8744740c-e346-4a34-b0db-9c5540e65ed7",
            "created": "2026-10-13T17:47:14.733Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0756#AN2255",
                    "external_id": "AN2255"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:14.733Z",
            "name": "Analytic 2255",
            "description": "Real-time monitoring identifies successful Secure Shell (SSH) or application authentication using credentials matching known default vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "syslog:auth",
                    "channel": "sshd Accepted for username matching default vendor credential list from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--87efd969-d991-49be-9e41-24f5dbcff9e8",
            "created": "2026-10-13T17:47:42.651Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0748#AN2273",
                    "external_id": "AN2273"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:42.651Z",
            "name": "Analytic 2273",
            "description": "Real-time monitoring identifies a registry write to Windows autorun keys or an AutoPlay/AutoRun configuration change referencing a binary path that is not part of the authorized Industrial Control System (ICS) software inventory, particularly in combination with removable media insertion. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=20001 correlated with autorun registry modification within autorun modification window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSSoftwareInventory",
                    "description": "Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts."
                },
                {
                    "field": "AutorunModificationWindow",
                    "description": "Time window correlating removable media insertion with a subsequent autorun configuration change."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--88dc7850-3f62-4822-90c0-3a1ed06cc044",
            "created": "2026-10-13T17:46:35.838Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0791#AN2220",
                    "external_id": "AN2220"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:35.838Z",
            "name": "Analytic 2220",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) embedded device executing a sequence of operations inconsistent with its programmed logic, correlating temporally with an operator interaction on an engineering terminal connected to the device. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "otndr:BehaviorAlert",
                    "channel": "device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDestinations",
                    "description": "Allowlist of network destinations consistent with legitimate document/link content."
                },
                {
                    "field": "ExpectedDocumentViewerChildren",
                    "description": "Documented normal child processes for legitimate document viewers/handlers."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--89b7a519-ee8c-4aac-a9ef-f82d32116d30",
            "created": "2026-10-13T17:47:59.034Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0902#AN2283",
                    "external_id": "AN2283"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:59.034Z",
            "name": "Analytic 2283",
            "description": "Real-time monitoring identifies a Windows process making Industrial Control System (ICS) protocol connections to device subnets from a process not in the authorized ICS applications list, structurally valid traffic from an unauthorized source. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 to device subnet from process not in authorized Industrial Control Systems (ICS) applications"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedCommunicationBaseline",
                    "description": "The complete, maintained inventory of every legitimate source-to-destination communication pair in the ICS environment."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8aac97f9-602a-440f-b846-7a11e6a157ca",
            "created": "2026-10-13T17:44:33.568Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0736#AN2129",
                    "external_id": "AN2129"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:33.568Z",
            "name": "Analytic 2129",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Linux service process initiating an outbound connection on a commonly-used port to a destination not in the approved vendor domain list. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect() syscall on port (e.g., 80, 443, 8080, etc.) to destination not in approved vendor domains, from Industrial Control Systems (ICS) service process"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor domains for software updates, licensing, or remote support."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose documented function never requires outbound internet connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8b7ed6ba-ae88-48ab-8aa1-48c15e23db4d",
            "created": "2026-10-13T17:44:38.338Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0740#AN2133",
                    "external_id": "AN2133"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:38.338Z",
            "name": "Analytic 2133",
            "description": "Real-time monitoring identifies web server or Industrial Control System (ICS) application logs showing exploit-pattern requests to Industrial Control System (ICS) vendor web interfaces, followed by the web server daemon User Identifier (UID) spawning unexpected shell processes. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "webserver:applog",
                    "channel": "Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate access to the ICS web interface is expected."
                },
                {
                    "field": "ExploitPatternSignatures",
                    "description": "Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."
                },
                {
                    "field": "ExploitToShellWindow",
                    "description": "Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8cf7c363-594f-4efc-a1e8-30435b5f1feb",
            "created": "2026-10-13T17:45:20.575Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0911#AN2165",
                    "external_id": "AN2165"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:20.575Z",
            "name": "Analytic 2165",
            "description": "Real-time monitoring identifies ip link set down commands on Industrial Control System (ICS) Linux gateway hosts by a User Identifier (UID) not in the authorized net admin UIDs, affecting the device subnet interface. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for switch configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which interface configuration changes are authorized."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8d30e2a3-b7a5-403b-ad5f-243f37f44fa4",
            "created": "2026-10-13T17:45:48.528Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0770#AN2184",
                    "external_id": "AN2184"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:48.528Z",
            "name": "Analytic 2184",
            "description": "Real-time monitoring identifies Simple Network Management Protocol (SNMP) walk requests, Cisco Discovery Protocol (CDP)/Link Layer Discovery Protocol (LLDP) enumeration frames, or Internet Control Message Protocol (ICMP)-based traceroute sequences from an Industrial Control System (ICS) host that has not previously generated management-protocol traffic. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAdmins",
                    "description": "Accounts with documented network administration responsibilities."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources for topology queries."
                },
                {
                    "field": "EnumerationTimeWindow",
                    "description": "Time window within which multiple enumeration commands are considered a systematic mapping sequence."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8e055360-9991-43ef-bd20-2b3f40432c78",
            "created": "2026-10-13T17:47:36.850Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0723#AN2268",
                    "external_id": "AN2268"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:36.850Z",
            "name": "Analytic 2268",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) Windows service (Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling service) consuming abnormal Central Processing Unit (CPU)/memory resources and becoming unresponsive following receipt of a high volume of connections to its application port, correlated with watchdog timeout or service crash events. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c",
                    "name": "WinEventLog:System",
                    "channel": "EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CPUUtilizationThreshold",
                    "description": "Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."
                },
                {
                    "field": "DoSConnectionThreshold",
                    "description": "Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."
                },
                {
                    "field": "DoSDetectionWindow",
                    "description": "Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."
                },
                {
                    "field": "ExpectedPollInterval",
                    "description": "Device-specific supervisory poll interval used to determine what counts as a process historian gap."
                },
                {
                    "field": "InterfaceErrorThreshold",
                    "description": "Deviation from baseline interface error/discard rate, tuned against historical interface health data."
                },
                {
                    "field": "MalformedPacketThreshold",
                    "description": "Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--8f09d2c6-0a02-486f-b468-f1e9519c35c7",
            "created": "2026-10-13T17:46:14.348Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0742#AN2208",
                    "external_id": "AN2208"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:14.348Z",
            "name": "Analytic 2208",
            "description": "Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opcua:AuditEvent",
                    "channel": "OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedApplicationList",
                    "description": "Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."
                },
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to invoke write/control methods."
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of process executables permitted to load ICS vendor automation API libraries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963",
            "created": "2026-10-13T17:47:37.720Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0726#AN2269",
                    "external_id": "AN2269"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:37.720Z",
            "name": "Analytic 2269",
            "description": "Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter (netsh wlan, WinPcap/Npcap driver load, etc.) on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception consistent with this technique's reconnaissance phase. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=6 for wireless capture driver on host not in designated wireless management station list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedWirelessDeviceInventory",
                    "description": "MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."
                },
                {
                    "field": "DesignatedWirelessManagementStations",
                    "description": "Hosts authorized to legitimately enable wireless monitor mode for diagnostics."
                },
                {
                    "field": "WirelessOnboardWindow",
                    "description": "Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--928c559b-3258-4760-a785-ba1270d7ea92",
            "created": "2026-10-13T17:46:00.102Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0758#AN2194",
                    "external_id": "AN2194"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:00.102Z",
            "name": "Analytic 2194",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) network device receiving a configuration erase command from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or outside a change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "networkdevice:syslog",
                    "channel": "write erase or factory-reset command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedDataManagementTools",
                    "description": "Allowlist of backup/archival/retention management tools authorized to perform bulk file operations."
                },
                {
                    "field": "BulkDeletionThreshold",
                    "description": "File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup."
                },
                {
                    "field": "DataDestructionTimeWindow",
                    "description": "Time window over which bulk deletion activity is measured."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue memory erase commands."
                },
                {
                    "field": "WiperCrashWindow",
                    "description": "Time window after bulk deletion within which a system crash is considered part of the same destructive event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9508cebc-ee97-47e6-b603-5fdf88f9f54f",
            "created": "2026-10-13T17:44:09.300Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0730#AN2111",
                    "external_id": "AN2111"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:09.300Z",
            "name": "Analytic 2111",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "VendorInstallManifest",
                    "description": "Documented list of files/registry keys a legitimate vendor installer is expected to create."
                },
                {
                    "field": "VendorInstallProfile",
                    "description": "Documented expected process behavior for a legitimate vendor installer, established through lab testing."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9510e414-3071-4e9c-af51-d07765393e32",
            "created": "2026-10-13T17:44:30.772Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0733#AN2127",
                    "external_id": "AN2127"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:30.772Z",
            "name": "Analytic 2127",
            "description": "Real-time monitoring identifies a mount event for removable storage media on an Industrial Control System (ICS) Linux asset, followed by execution of a binary from the mounted path within a short window. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedUSBAllowlist",
                    "description": "Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "USBExecutionWindow",
                    "description": "Time window after device insertion/mount within which process execution is considered directly connected to the insertion event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--952ff035-fa50-4462-85e1-ee0287b68922",
            "created": "2026-10-13T17:47:12.770Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0796#AN2253",
                    "external_id": "AN2253"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:12.770Z",
            "name": "Analytic 2253",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) device or server accepting an inbound connection on its native protocol port from a source Internet Protocol (IP) address outside the organization's address space. Documented in Trend Micro's manufacturing honeypot research, with adversaries exploiting exposed Siemens S7, Omron Factory Interface Network Service (FINS), EtherNet/IP, and misconfigured Virtual Network Computing (VNC). OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "perimeter:firewall",
                    "channel": "inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "OrganizationalIPSpace",
                    "description": "Documented internal/organizational IP address ranges."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--984bc0c8-77ee-4971-ba17-6a89fc401315",
            "created": "2026-10-13T17:46:21.543Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0777#AN2211",
                    "external_id": "AN2211"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:21.543Z",
            "name": "Analytic 2211",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol write specifically targeting alarm threshold/deadband configuration registers from a source not in the approved engineering list, where the new value widens the alarm deadband or shifts the trip point beyond the safe operating envelope, without operator acknowledgment. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "alarm threshold configuration changed without operator_ack or change ticket reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write to alarm threshold address range from source not in approved write sources with new value outside safe alarm threshold range"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmThresholdAddressRange",
                    "description": "Register addresses specifically corresponding to alarm threshold/deadband configuration."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to modify alarm configuration."
                },
                {
                    "field": "SafeAlarmThresholdRange",
                    "description": "Documented safe range for alarm thresholds per parameter."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--99652f40-1f48-4a01-9e09-0585e02ce534",
            "created": "2026-10-13T17:48:01.582Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0908#AN2284",
                    "external_id": "AN2284"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:01.582Z",
            "name": "Analytic 2284",
            "description": "Real-time monitoring identifies a Windows process sending Industrial Control System (ICS) broadcast discovery frames from a process not associated with a recognized ICS asset management or commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized on the ICS network segment."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--99cde5ec-8f9f-4585-9195-5ed4509dc9cd",
            "created": "2026-10-13T17:48:08.042Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0742#AN2289",
                    "external_id": "AN2289"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:08.042Z",
            "name": "Analytic 2289",
            "description": "Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "zeek:ssl",
                    "channel": "Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedApplicationList",
                    "description": "Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."
                },
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to invoke write/control methods."
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of process executables permitted to load ICS vendor automation API libraries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9a06af00-5f21-43c8-a4a3-24eaa28655c2",
            "created": "2026-10-13T17:45:56.223Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0733#AN2190",
                    "external_id": "AN2190"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:56.223Z",
            "name": "Analytic 2190",
            "description": "Real-time monitoring identifies a new device connecting to an Industrial Control System (ICS) network switch port that was previously unused or previously assigned to a different device Media Access Control (MAC) address immediately following physical access to the environment, with subsequent Industrial Control System (ICS) protocol traffic to field devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedUSBAllowlist",
                    "description": "Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "USBExecutionWindow",
                    "description": "Time window after device insertion/mount within which process execution is considered directly connected to the insertion event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9b1bb08d-5aba-47f4-86d7-a5788c99e1ac",
            "created": "2026-10-13T17:46:07.425Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0800#AN2202",
                    "external_id": "AN2202"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:07.425Z",
            "name": "Analytic 2202",
            "description": "Real-time monitoring identifies unauthorized Switch Port Analyzer (SPAN) session configuration or port mirroring enabled from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) on an Industrial Control System (ICS) switch. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAnalysts",
                    "description": "Accounts with documented network analysis/diagnostic responsibilities."
                },
                {
                    "field": "AuthorizedCaptureSoftware",
                    "description": "Allowlist of approved packet capture tools and processes that legitimately load capture drivers."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9e2addaf-2773-4bd1-8192-231451038024",
            "created": "2026-10-13T17:44:17.351Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0777#AN2117",
                    "external_id": "AN2117"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:17.351Z",
            "name": "Analytic 2117",
            "description": "Real-time monitoring identifies a write to alarm threshold configuration files on a Linux-based alarm server by a User Identifier (UID) that is not the alarm management service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to alarm threshold config file by uid not in authorized alarm admin User Identifiers (UIDs)"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmThresholdAddressRange",
                    "description": "Register addresses specifically corresponding to alarm threshold/deadband configuration."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to modify alarm configuration."
                },
                {
                    "field": "SafeAlarmThresholdRange",
                    "description": "Documented safe range for alarm thresholds per parameter."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--9fac6c8a-9320-47d1-aa1d-3bdd4f5856d3",
            "created": "2026-10-13T17:45:09.213Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0800#AN2156",
                    "external_id": "AN2156"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:09.213Z",
            "name": "Analytic 2156",
            "description": "Real-time monitoring identifies a process opening a raw socket or executing tcpdump/tshark on an Industrial Control System (ICS) Linux asset's network interface, from a User Identifier (UID) that does not normally perform packet capture. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs)"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNetworkAnalysts",
                    "description": "Accounts with documented network analysis/diagnostic responsibilities."
                },
                {
                    "field": "AuthorizedCaptureSoftware",
                    "description": "Allowlist of approved packet capture tools and processes that legitimately load capture drivers."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a0774b4b-493d-4025-bf19-b94280371478",
            "created": "2026-10-13T17:45:32.099Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0727#AN2169",
                    "external_id": "AN2169"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:32.099Z",
            "name": "Analytic 2169",
            "description": "Real-time monitoring identifies NetFlow showing a host generating an anomalously high volume of short-duration flows to multiple field device IPs at regular intervals, from a source not in the approved Supervisory Control and Data Acquisition (SCADA) server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to connect."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices."
                },
                {
                    "field": "BaselinePollRate",
                    "description": "Measured normal polling frequency per device, derived from actual baseline traffic capture."
                },
                {
                    "field": "KnownTagAddressRanges",
                    "description": "Documented register/tag address ranges that legitimate SCADA polling actually queries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a0c69c57-549d-4cdd-82eb-0654d8df364e",
            "created": "2026-10-13T17:46:45.467Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0745#AN2229",
                    "external_id": "AN2229"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:45.467Z",
            "name": "Analytic 2229",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service placing a file on a field device from a source not in the approved engineering workstation list, where the transferred filename pattern matches firmware images or executable payloads inconsistent with the device's normal data exchange profile. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "otids:ProtocolDecoder",
                    "channel": "Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFileSources",
                    "description": "Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "SuspiciousFilePatterns",
                    "description": "Filename/extension patterns inconsistent with the device's normal configuration exchange profile."
                },
                {
                    "field": "ToolTransferWindow",
                    "description": "Time window after file creation within which execution is considered directly connected to the transfer event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a24f00d8-2d62-465a-a63c-5604058d195e",
            "created": "2026-10-13T17:45:39.691Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0764#AN2176",
                    "external_id": "AN2176"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:39.691Z",
            "name": "Analytic 2176",
            "description": "Real-time monitoring identifies network device configuration changes (network address translation rules, static routes, access control list modifications) combined with NetFlow path deviations for Industrial Control System (ICS) device traffic and Transport Layer Security (TLS) certificate issuer anomalies in Operational Technology (OT) management traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AiTMCorrelationWindow",
                    "description": "Time window within which a MAC binding change and protocol baseline deviation are considered correlated."
                },
                {
                    "field": "ExpectedNextHopBaseline",
                    "description": "Documented expected network path for device subnet traffic."
                },
                {
                    "field": "TopologyChangeTicket",
                    "description": "Change-management reference confirming an authorized hardware replacement or topology modification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a2ab9718-e601-4c5d-94ad-6382df57987c",
            "created": "2026-10-13T17:44:55.885Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0780#AN2146",
                    "external_id": "AN2146"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:55.885Z",
            "name": "Analytic 2146",
            "description": "Real-time monitoring identifies inconsistencies between auditd-recorded process activity and what /proc reports, or kernel module loads from non-standard paths on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "FirmwareIntegrityScanSchedule",
                    "description": "Frequency of out-of-band firmware integrity verification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a318c729-65ad-424b-a67b-c6b38fb0a708",
            "created": "2026-10-13T17:47:30.129Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0784#AN2263",
                    "external_id": "AN2263"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:30.129Z",
            "name": "Analytic 2263",
            "description": "Real-time monitoring identifies Windows host-based firewall rule modifications or network interface configuration changes on Industrial Control System (ICS) Windows servers that block ICS command-message traffic, coinciding with Supervisory Control and Data Acquisition (SCADA) showing communication loss to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "WinEventLog:Security",
                    "channel": "EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommandConfirmationWindow",
                    "description": "Maximum expected latency between a command being issued and its corresponding state-change confirmation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a4594062-42a7-448f-99fb-5e4b2c005410",
            "created": "2026-10-13T17:44:53.414Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0772#AN2144",
                    "external_id": "AN2144"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:53.414Z",
            "name": "Analytic 2144",
            "description": "Real-time monitoring identifies Secure Shell (SSH) sessions with X11 forwarding or Virtual Network Computing (VNC) connections to Industrial Control System (ICS) Linux hosts from unexpected source Internet Protocol (IP) addresses, combined with X11 application launches from the session. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementCIDR",
                    "description": "IP ranges authorized for remote desktop/console access to ICS hosts."
                },
                {
                    "field": "ApprovedOperatorList",
                    "description": "Accounts with documented operator/engineer roles."
                },
                {
                    "field": "ApprovedOperatorWorkstations",
                    "description": "Inventory of workstations from which operator/engineer interactive sessions are expected to originate."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a607836b-d6d0-4501-8f05-b43a5dac09c8",
            "created": "2026-10-13T17:44:10.401Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0748#AN2112",
                    "external_id": "AN2112"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:10.401Z",
            "name": "Analytic 2112",
            "description": "Real-time monitoring identifies modification of udev rules or autofs configuration that triggers script execution on removable media mount, where the triggered script path is not in the authorized Industrial Control System (ICS) software inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSSoftwareInventory",
                    "description": "Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts."
                },
                {
                    "field": "AutorunModificationWindow",
                    "description": "Time window correlating removable media insertion with a subsequent autorun configuration change."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a7766ca3-ff83-48fe-b6aa-5a781c64d95b",
            "created": "2026-10-13T17:43:57.611Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0728#AN2107",
                    "external_id": "AN2107"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:57.611Z",
            "name": "Analytic 2107",
            "description": "Real-time monitoring identifies a write to alarm configuration files on a Linux-based Supervisory Control and Data Acquisition (SCADA)/alarm server by a User Identifier (UID) that is not the alarm management service, or the alarm management service process receiving Application Programming Interface (API) calls that suppress alarm classes without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "alarmserver:ApplicationLog",
                    "channel": "alarm suppression Application Programming Interface (API) call logged without operator session identifier (ID)"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmConfigAddressRange",
                    "description": "Protocol register/address ranges corresponding to alarm threshold and configuration values per device type."
                },
                {
                    "field": "AlarmConfigPaths",
                    "description": "File system paths for alarm configuration files/databases on Windows alarm servers."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to ICS devices, including alarm configuration."
                },
                {
                    "field": "HMIAlarmParentAllowlist",
                    "description": "Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration."
                },
                {
                    "field": "SuppressGracePeriod",
                    "description": "Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--a97db312-a06f-4020-aef2-b28bb8d78c56",
            "created": "2026-10-13T17:46:10.320Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0911#AN2204",
                    "external_id": "AN2204"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:10.320Z",
            "name": "Analytic 2204",
            "description": "Real-time monitoring identifies a switch interface transitioning to administratively-down state on a port connected to an Industrial Control System (ICS) field device, from a configuration change source not in the approved network administration list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for switch configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which interface configuration changes are authorized."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--aa83b39c-238f-4592-abaa-35e011218f98",
            "created": "2026-10-13T17:47:04.917Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0758#AN2248",
                    "external_id": "AN2248"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:04.917Z",
            "name": "Analytic 2248",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol command sequence that erases device memory, from a source not in the approved engineering workstation list, where the device subsequently becomes unresponsive or requires re-commissioning. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Initialize_Memory or MEMORY_RESET service from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedDataManagementTools",
                    "description": "Allowlist of backup/archival/retention management tools authorized to perform bulk file operations."
                },
                {
                    "field": "BulkDeletionThreshold",
                    "description": "File count threshold across monitored directories that distinguishes bulk destruction from routine cleanup."
                },
                {
                    "field": "DataDestructionTimeWindow",
                    "description": "Time window over which bulk deletion activity is measured."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue memory erase commands."
                },
                {
                    "field": "WiperCrashWindow",
                    "description": "Time window after bulk deletion within which a system crash is considered part of the same destructive event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ac890be9-5686-42bf-9a1c-ac7fd8bb283a",
            "created": "2026-10-13T17:46:18.406Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0788#AN2210",
                    "external_id": "AN2210"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:18.406Z",
            "name": "Analytic 2210",
            "description": "Real-time monitoring identifies an Open Platform Communications (OPC) client process on an Industrial Control System (ICS) Windows host calling BrowseNamespace or GetProperties to enumerate the full tag tree, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client identities authorized for namespace browsing."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate polling/browsing sources."
                },
                {
                    "field": "NamespaceCoverageThreshold",
                    "description": "Percentage of total device tag/object space accessed within a session constituting full enumeration."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ad07439d-e13e-438a-9f4b-330d61f2607b",
            "created": "2026-10-13T17:44:08.147Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0722#AN2110",
                    "external_id": "AN2110"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:08.147Z",
            "name": "Analytic 2110",
            "description": "Real-time monitoring identifies a process setting LD_PRELOAD before launching an Industrial Control System (ICS) service binary, or writing to /etc/ld.so.preload, where the injected library path is not part of the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to /etc/ld.so.preload by User Identifier (UID) outside authorized admin list"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with env containing LD_PRELOAD where exe matches Industrial Control Systems (ICS) service binary list and preload library not in vendor package manifest"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedICSVendorProcessList",
                    "description": "Allowlist of processes permitted to install window/event hooks on ICS engineering and HMI hosts."
                },
                {
                    "field": "ICSServiceBinaryList",
                    "description": "List of binary paths for ICS gateway, OPC, and historian services on Linux assets that should never be launched with LD_PRELOAD set."
                },
                {
                    "field": "VendorPackageManifest",
                    "description": "Package manager manifest cross-reference confirming a shared library belongs to an installed, signed package."
                },
                {
                    "field": "VendorSignedDLLHashBaseline",
                    "description": "Cryptographic hash inventory of all vendor-signed ICS communication DLLs, refreshed on every legitimate vendor patch cycle."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--aef5883b-f520-4309-aacc-d233b31ec860",
            "created": "2026-10-13T17:44:16.185Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0766#AN2116",
                    "external_id": "AN2116"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:16.185Z",
            "name": "Analytic 2116",
            "description": "Real-time monitoring identifies a write to Industrial Control System (ICS) project file paths on a Linux engineering station from a User Identifier (UID) not associated with the ICS engineering tool, or from the tool after loading a file from a removable media or network path not in the approved software distribution list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedProjectRepository",
                    "description": "Documented, trusted source location(s) for project files."
                },
                {
                    "field": "AuthorizedEngineeringTools",
                    "description": "Allowlist of vendor engineering software processes authorized to modify project files."
                },
                {
                    "field": "ProjectFileExtensions",
                    "description": "File extensions used by ICS engineering project files for in-use vendor platforms."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--af14d56d-c96c-4ab4-8377-a3ecfba26962",
            "created": "2026-10-13T17:44:41.445Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0745#AN2135",
                    "external_id": "AN2135"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:41.445Z",
            "name": "Analytic 2135",
            "description": "Real-time monitoring identifies execution on an ICS Linux asset of an executable or script from a path commonly used for inbound file transfer or staging, by a UID outside the approved deployment/administration baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFileSources",
                    "description": "Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "SuspiciousFilePatterns",
                    "description": "Filename/extension patterns inconsistent with the device's normal configuration exchange profile."
                },
                {
                    "field": "ToolTransferWindow",
                    "description": "Time window after file creation within which execution is considered directly connected to the transfer event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b011484e-65d1-408a-b361-67d945e9ca87",
            "created": "2026-10-13T17:44:26.091Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0725#AN2123",
                    "external_id": "AN2123"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:26.091Z",
            "name": "Analytic 2123",
            "description": "Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5",
                    "name": "linux:pkgintegrity",
                    "channel": "rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AssetInventoryDeviceTypes",
                    "description": "Maintained inventory of expected vendor/product identity strings per enrolled device IP."
                },
                {
                    "field": "ICSDaemonNames",
                    "description": "List of expected Linux ICS service daemon process names."
                },
                {
                    "field": "ICSVendorProcessNames",
                    "description": "List of known ICS vendor executable names used as the masquerade-target watchlist."
                },
                {
                    "field": "VendorHashBaseline",
                    "description": "Cryptographic hash inventory for all legitimate versions of vendor ICS binaries, updated on every patch cycle."
                },
                {
                    "field": "VendorInstallPaths",
                    "description": "Authorized installation directories for each ICS vendor application."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b03ff220-3bf8-41bd-a443-0ae287fa8e74",
            "created": "2026-10-13T17:45:15.479Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0907#AN2161",
                    "external_id": "AN2161"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:15.479Z",
            "name": "Analytic 2161",
            "description": "Real-time monitoring identifies execve of port scanning utilities on an Industrial Control System (ICS) Linux asset with arguments targeting ICS protocol port ranges. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources."
                },
                {
                    "field": "PortScanTimeWindow",
                    "description": "Time window within which connections across multiple ports are considered a single scan event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b048b681-7bce-468e-896b-da76f8b81d49",
            "created": "2026-10-13T17:46:44.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0733#AN2228",
                    "external_id": "AN2228"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:44.589Z",
            "name": "Analytic 2228",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service such as Distributed Network Protocol 3 (DNP3) File Transfer Object or Internet Electrotechnical Commision (IEC) 61850 file service being used to place files on a field device from a source not in the approved engineering workstation list, outside a scheduled maintenance window, where the transfer source is a device not previously enrolled. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "otids:ProtocolDecoder",
                    "channel": "Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedUSBAllowlist",
                    "description": "Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform file transfers to field devices."
                },
                {
                    "field": "USBExecutionWindow",
                    "description": "Time window after device insertion/mount within which process execution is considered directly connected to the insertion event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b15aa5f3-acb3-4de6-831b-3f2a259baf63",
            "created": "2026-10-13T17:47:20.300Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0801#AN2260",
                    "external_id": "AN2260"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:20.300Z",
            "name": "Analytic 2260",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) vendor engineering software initiating a device restart command from a Windows host outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "device restart command initiated outside change control window by account not in approved engineer list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "BulkRestartTimeWindow",
                    "description": "Time window within which multiple device restarts are considered a coordinated event."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which restarts are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to issue device restart commands."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b1b08627-62b0-4ede-b07d-478be9721f5a",
            "created": "2026-10-13T17:47:13.564Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0744#AN2254",
                    "external_id": "AN2254"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:13.564Z",
            "name": "Analytic 2254",
            "description": "Real-time monitoring identifies an Secure Shell (SSH) connection to an Industrial Control System (ICS) Linux asset from a source Internet Protocol (IP) address that appeared on the ICS network within a short window and is not in the approved device inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X."
                },
                {
                    "field": "NewDeviceWindow",
                    "description": "Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b1e81f19-f241-45ef-bfa5-2aa27d99ee0c",
            "created": "2026-10-13T17:45:41.465Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0792#AN2178",
                    "external_id": "AN2178"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:41.465Z",
            "name": "Analytic 2178",
            "description": "Real-time monitoring identifies a new device appearing on the Industrial Control System (ICS) network with network behavior consistent with an ICS master station, with a Media Access Control (MAC) address not in the approved device inventory. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP/identity allowlist of legitimate master/control server systems."
                },
                {
                    "field": "RegisteredMasterAddresses",
                    "description": "Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."
                },
                {
                    "field": "RogueMasterTimeWindow",
                    "description": "Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b26ae113-36e8-4ff4-94bb-bf058788979c",
            "created": "2026-10-13T17:44:11.584Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0750#AN2113",
                    "external_id": "AN2113"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:11.584Z",
            "name": "Analytic 2113",
            "description": "Real-time monitoring identifies truncation or deletion of Industrial Control System (ICS) application or auth log files, or modification of bash history, by a User Identifier (UID) that does not normally manage log rotation. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedLogManagementTools",
                    "description": "Allowlist of processes/accounts authorized to delete or truncate ICS application logs."
                },
                {
                    "field": "LogClearLookbackWindow",
                    "description": "Time window prior to a log-clear event within which other suspicious activity is considered correlated."
                },
                {
                    "field": "ScheduledLogRotationWindow",
                    "description": "Documented schedule for legitimate, automated log rotation/archival."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b3107fc4-e41d-4e1c-a895-6e6cdc9182ca",
            "created": "2026-10-13T17:45:16.880Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0908#AN2162",
                    "external_id": "AN2162"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:16.880Z",
            "name": "Analytic 2162",
            "description": "Real-time monitoring identifies a Linux process sending User Datagram Protocol (UDP) broadcast packets to Industrial Control System (ICS) discovery addresses from a User Identifier (UID) not associated with any recognized ICS commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized on the ICS network segment."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b41c2b27-08ce-4f3c-a810-484f100422a3",
            "created": "2026-10-13T17:45:37.638Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0749#AN2174",
                    "external_id": "AN2174"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:37.638Z",
            "name": "Analytic 2174",
            "description": "Real-time monitoring identifies large outbound data transfers from Industrial Control System (ICS) server Internet Protocol (IP) addresses to destinations outside the approved ICS zone, following a pattern of bulk reads from engineering document stores or historian databases. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to perform legitimate bulk reads of ICS data."
                },
                {
                    "field": "BulkAccessThreshold",
                    "description": "Number of distinct files read within the detection window that constitutes bulk collection."
                },
                {
                    "field": "ICSDataPaths",
                    "description": "File system paths containing ICS configuration, project, and sensitive operational data."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b4b66413-59b9-45bb-93d4-a0a99da9e9a4",
            "created": "2026-10-13T17:44:46.087Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0753#AN2138",
                    "external_id": "AN2138"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:46.087Z",
            "name": "Analytic 2138",
            "description": "Real-time monitoring identifies a process making direct ioctl or mmap syscalls against Industrial Control System (ICS) hardware device files, bypassing the vendor's documented Application Programming Interface (API) layer, from a process not in the recognized ICS application list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to interact with ICS hardware/protocols."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b4eeeacf-6d03-4350-ae75-b87e28b697bc",
            "created": "2026-10-13T17:44:18.511Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0784#AN2118",
                    "external_id": "AN2118"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:18.511Z",
            "name": "Analytic 2118",
            "description": "Real-time monitoring identifies iptables/nftables rule additions on Industrial Control System (ICS) Linux gateways that filter ICS command messages based on content, while allowing other traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommandConfirmationWindow",
                    "description": "Maximum expected latency between a command being issued and its corresponding state-change confirmation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b89b2084-97e0-47cc-a9fd-bea4d0423b06",
            "created": "2026-10-13T17:46:56.610Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0767#AN2240",
                    "external_id": "AN2240"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:56.610Z",
            "name": "Analytic 2240",
            "description": "Real-time monitoring identifies malformed, oversized, or out-of-spec ICS protocol messages sent to an embedded field device from an unexpected or unauthorized source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate connections to network-facing ICS services are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--b968d9b9-b7f6-423b-b490-6a43ed97389f",
            "created": "2026-10-13T17:46:08.313Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0905#AN2203",
                    "external_id": "AN2203"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:08.313Z",
            "name": "Analytic 2203",
            "description": "Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using default or hardcoded vendor credentials from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "networkdevice:syslog",
                    "channel": "Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                },
                {
                    "field": "KnownHardcodedCredentialPatterns",
                    "description": "Documented hardcoded credential values for in-use ICS products."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--bd1cb276-2ab0-4a91-8099-5c8a957e4968",
            "created": "2026-10-13T17:47:49.520Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0777#AN2276",
                    "external_id": "AN2276"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:49.520Z",
            "name": "Analytic 2276",
            "description": "Real-time monitoring identifies a write to alarm threshold configuration on an Human-Machine Interface (HMI)/alarm server from a process other than the recognized alarm management application, without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 to alarm threshold config path by image not in Human-Machine Interface (HMI) alarm parent allowlist"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmThresholdAddressRange",
                    "description": "Register addresses specifically corresponding to alarm threshold/deadband configuration."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to modify alarm configuration."
                },
                {
                    "field": "SafeAlarmThresholdRange",
                    "description": "Documented safe range for alarm thresholds per parameter."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--bed265af-6f51-42c1-b4d2-691535a32d67",
            "created": "2026-10-13T17:46:42.631Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0907#AN2226",
                    "external_id": "AN2226"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:42.631Z",
            "name": "Analytic 2226",
            "description": "Real-time monitoring identifies rapid sequential Industrial Control System (ICS) protocol connection attempts to the same field device Internet Protocol (IP) address across different protocol ports from a single source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "NSM:Connections",
                    "channel": "rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources."
                },
                {
                    "field": "PortScanTimeWindow",
                    "description": "Time window within which connections across multiple ports are considered a single scan event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--beefb21a-0c89-4472-8a35-b1ac557018b5",
            "created": "2026-10-13T17:46:48.853Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0908#AN2233",
                    "external_id": "AN2233"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:48.853Z",
            "name": "Analytic 2233",
            "description": "Real-time monitoring identifies broadcast discovery frames on the Industrial Control System (ICS) network from a source Media Access Control (MAC)/Internet Protocol (IP) address not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDeviceInventory",
                    "description": "MAC address inventory of devices authorized on the ICS network segment."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--bef23fc2-f276-4dc4-9e09-c3c546c431a1",
            "created": "2026-10-13T17:45:05.421Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0794#AN2153",
                    "external_id": "AN2153"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:05.421Z",
            "name": "Analytic 2153",
            "description": "Real-time monitoring identifies a Linux process making Open Platform Communications (OPC) Unified Architecture (UA) write calls or direct Industrial Control System (ICS) protocol command connections to field device output addresses, from a User Identifier (UID) not associated with the authorized control application. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate control sources."
                },
                {
                    "field": "RapidToggleWindow",
                    "description": "Time window within which multiple safety-critical output changes are considered a coordinated event."
                },
                {
                    "field": "SafetyCriticalOutputAddresses",
                    "description": "Documented register/IOA addresses corresponding to safety-critical outputs per device."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c0e95b25-fa40-4794-a262-498aff3b9fd1",
            "created": "2026-10-13T17:46:12.728Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0727#AN2206",
                    "external_id": "AN2206"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:12.729Z",
            "name": "Analytic 2206",
            "description": "Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host querying device operating state or process values via vendor Application Programming Interfaces (APIs) at a frequency or scope exceeding documented Human-Machine Interface (HMI) refresh behavior, from a process not in the recognized HMI/Supervisory Control and Data Acquisition (SCADA) application list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "opc:applog",
                    "channel": "Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to connect."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices."
                },
                {
                    "field": "BaselinePollRate",
                    "description": "Measured normal polling frequency per device, derived from actual baseline traffic capture."
                },
                {
                    "field": "KnownTagAddressRanges",
                    "description": "Documented register/tag address ranges that legitimate SCADA polling actually queries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c17121b6-e945-4799-8a00-77d183501a1e",
            "created": "2026-10-13T17:46:26.646Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0911#AN2214",
                    "external_id": "AN2214"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:26.646Z",
            "name": "Analytic 2214",
            "description": "Real-time monitoring identifies device_ip offline alarm coinciding with switch port admin-down syslog for that port, distinguishing deliberate Ethernet blocking from physical disconnection. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "device offline alarm coinciding with switch port admin-down syslog for that port"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges authorized for switch configuration changes."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which interface configuration changes are authorized."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c",
            "created": "2026-10-13T17:47:24.974Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0738#AN2261",
                    "external_id": "AN2261"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:24.974Z",
            "name": "Analytic 2261",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) operator/service account being granted elevated Windows privileges without a corresponding administrative logon event, or a process crash in an Industrial Control System (ICS) vendor application immediately followed by a new process inheriting elevated token privileges. Documented in PIPEDREAM's LAZYCARGO component, which drops and exploits a known vulnerable ASRock driver to elevate credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account without corresponding admin-group logon in preceding session"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=6 of a known vulnerable third-party driver immediately preceding privilege escalation indicators"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window within which a device/process crash and subsequent privileged action are considered correlated."
                },
                {
                    "field": "KnownVulnerableDriverSignatures",
                    "description": "Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique)."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c2027adc-ff27-4bdc-a9bd-2e96b4aacc15",
            "created": "2026-10-13T17:47:44.553Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0751#AN2274",
                    "external_id": "AN2274"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:44.553Z",
            "name": "Analytic 2274",
            "description": "Real-time monitoring identifies a process invoking screen capture Application Programming Interfaces (APIs) targeting an Human-Machine Interface (HMI) or operator workstation window, where the calling process is not a recognized Industrial Control System (ICS) vendor application or approved remote support tool, immediately followed by an image file write. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=11 by same process within capture to file window of the Application Programming Interface (API) call"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=7 of GDI32.dll/User32.dll by process not in authorized screen capture tools on Human-Machine Interface (HMI)-classified host"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedScreenCaptureTools",
                    "description": "Allowlist of remote support, training, or documentation tools legitimately authorized to perform screen capture."
                },
                {
                    "field": "CaptureToFileWindow",
                    "description": "Time window correlating a screen capture API call with a subsequent image file write."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c41ec8c0-34b0-4573-8643-7366cfbbe4ac",
            "created": "2026-10-13T17:45:47.613Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0753#AN2183",
                    "external_id": "AN2183"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:47.613Z",
            "name": "Analytic 2183",
            "description": "Use an OT-capable protocol decoder to monitor SNMP requests/responses and identify access to vendor-internal or undocumented OIDs from sources outside the approved NMS inventory, especially SET operations or unusual walks against control-network infrastructure. This is network-protocol observation, not OS API execution; require decoded SNMP transaction content or equivalent packet inspection.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "otids:ProtocolDecoder",
                    "channel": "SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of processes expected to interact with ICS hardware/protocols."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c4d5acb4-61c8-4142-bf26-5865d235f02f",
            "created": "2026-10-13T17:45:55.192Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0730#AN2189",
                    "external_id": "AN2189"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:55.192Z",
            "name": "Analytic 2189",
            "description": "Real-time monitoring identifies a network infrastructure device exhibiting behavioral anomalies (unexpected listening ports, new routing entries) after a vendor firmware update or hardware replacement, where the device firmware hash does not match the authorized inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "unexpected listening port or routing table change following firmware update event"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "VendorInstallManifest",
                    "description": "Documented list of files/registry keys a legitimate vendor installer is expected to create."
                },
                {
                    "field": "VendorInstallProfile",
                    "description": "Documented expected process behavior for a legitimate vendor installer, established through lab testing."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c5204537-15c5-42ff-baee-f7d029157ca9",
            "created": "2026-10-13T17:44:22.547Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0906#AN2120",
                    "external_id": "AN2120"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:22.547Z",
            "name": "Analytic 2120",
            "description": "Real-time monitoring identifies a write to a Siemens project file path on a Linux engineering workstation from a User Identifier (UID) not associated with the Siemens engineering tool runtime. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8",
                    "name": "auditd:SYSCALL+PATH",
                    "channel": "Linux Audit SYSCALL+PATH records: write to Siemens project file path by User Identifier (UID) not in authorized Siemens engineering UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedProjectRepository",
                    "description": "Documented, trusted source location(s) for Siemens project files."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c5274e54-6a55-4aae-b438-aed5c1ef8acd",
            "created": "2026-10-13T17:47:19.423Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0731#AN2259",
                    "external_id": "AN2259"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:19.423Z",
            "name": "Analytic 2259",
            "description": "Real-time monitoring identifies a vendor firmware update utility executing outside a scheduled maintenance window or invoked by an account not in the approved firmware management role, immediately followed by a network session to a field device IP on its firmware protocol port. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "engineeringworkstation:ApplicationLog",
                    "channel": "firmware session initiated outside maintenance window schedule without change ticket reference"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 firmware-update utility spawned by an account outside the authorized firmware-management set or outside the approved maintenance window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AuthorizedFirmwareInventory",
                    "description": "Cryptographic hash inventory of authorized firmware versions per device model."
                },
                {
                    "field": "AuthorizedFirmwareManagers",
                    "description": "Accounts authorized to perform firmware update operations."
                },
                {
                    "field": "ChangeControlWindow",
                    "description": "Scheduled maintenance periods during which firmware updates are authorized."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of workstations authorized to perform firmware updates."
                },
                {
                    "field": "FirmwareSessionSizeThreshold",
                    "description": "Minimum byte count for a session to be considered a firmware transfer rather than routine configuration traffic, derived from known firmware image sizes."
                },
                {
                    "field": "FirmwareUpdateWindow",
                    "description": "Time window within which a device reboot following a large session is considered part of the same firmware update event."
                },
                {
                    "field": "MaintenanceWindowSchedule",
                    "description": "Recurring scheduled periods when firmware updates are expected to occur."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c5bd7cb8-0223-4cc6-a390-80178e24e48d",
            "created": "2026-10-13T17:43:59.535Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0730#AN2109",
                    "external_id": "AN2109"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:43:59.535Z",
            "name": "Analytic 2109",
            "description": "Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--b9d031bb-d150-4fc6-8025-688201bf3ffd",
                    "name": "assetinventory:FirmwareHash",
                    "channel": "post-update firmware hash does not match vendor-published checksum for the claimed version"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "VendorInstallManifest",
                    "description": "Documented list of files/registry keys a legitimate vendor installer is expected to create."
                },
                {
                    "field": "VendorInstallProfile",
                    "description": "Documented expected process behavior for a legitimate vendor installer, established through lab testing."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c6552643-bbf2-4686-b050-af6f652fca79",
            "created": "2026-10-13T17:44:49.649Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0767#AN2141",
                    "external_id": "AN2141"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:49.649Z",
            "name": "Analytic 2141",
            "description": "Real-time monitoring identifies an ICS Linux network-facing service spawning a shell, interpreter, or other child process outside the expected service-child baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate connections to network-facing ICS services are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4",
            "created": "2026-10-13T17:47:54.751Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0795#AN2279",
                    "external_id": "AN2279"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:54.751Z",
            "name": "Analytic 2279",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) vendor process crashing unexpectedly, immediately preceded by an unusual cross-process memory access event from a process outside the recognized security/diagnostic tool allowlist. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=10 cross-process memory access into Industrial Control Systems (ICS) vendor process from image not in trusted security tool list, followed by unexpected termination within exploit crash correlation window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window correlating a memory access event with a subsequent crash."
                },
                {
                    "field": "TrustedSecurityToolList",
                    "description": "Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ca6b9523-4eba-48b2-8584-bed6fb3e6020",
            "created": "2026-10-13T17:45:34.934Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0739#AN2172",
                    "external_id": "AN2172"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:34.934Z",
            "name": "Analytic 2172",
            "description": "Real-time monitoring identifies Internet Control Message Protocol (ICMP) echo sweeps, Address Resolution Protocol (ARP) broadcast floods, or Industrial Control System (ICS)-specific discovery protocol packets from a host generating traffic to all IPs in a subnet in sequential order, a sweep pattern distinct from normal operational traffic to known device Internet Protocol (IP) addresses only. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate engineering and SCADA systems."
                },
                {
                    "field": "AuthorizedNetworkTools",
                    "description": "Allowlist of network management/diagnostic tools authorized for use on ICS hosts."
                },
                {
                    "field": "DiscoveryTimeWindow",
                    "description": "Time window within which sequential connections across the address range are considered a single discovery sweep event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--caa6869b-e752-4fb8-a228-09abaa2d321c",
            "created": "2026-10-13T17:46:35.037Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0905#AN2219",
                    "external_id": "AN2219"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:35.037Z",
            "name": "Analytic 2219",
            "description": "Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) device or application using credentials that are either documented vendor defaults (T1694.001) or extracted from configuration files/firmware where stored in cleartext (T1694.002), from a source not in the approved access list. This technique-level analytic unifies both sub-techniques. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "DefaultVendorCredentialList",
                    "description": "Documented default username/password combinations for all device models in the environment."
                },
                {
                    "field": "EngineeringWorkstationList",
                    "description": "IP allowlist of legitimate authentication sources."
                },
                {
                    "field": "KnownHardcodedCredentialPatterns",
                    "description": "Documented hardcoded credential values for in-use ICS products."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--cc87a984-9ec1-40c8-bcc3-14e9c51ef9fd",
            "created": "2026-10-13T17:45:01.419Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0791#AN2150",
                    "external_id": "AN2150"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:01.419Z",
            "name": "Analytic 2150",
            "description": "Real-time monitoring identifies a user-facing application on an ICS Linux workstation spawning a child process outside the expected application-child baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedDestinations",
                    "description": "Allowlist of network destinations consistent with legitimate document/link content."
                },
                {
                    "field": "ExpectedDocumentViewerChildren",
                    "description": "Documented normal child processes for legitimate document viewers/handlers."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d1985f23-da68-4b46-a5ab-9645ab91a25b",
            "created": "2026-10-13T17:44:24.905Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0724#AN2122",
                    "external_id": "AN2122"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:24.905Z",
            "name": "Analytic 2122",
            "description": "Real-time monitoring identifies Secure Shell (SSH) or local authentication by an Industrial Control System (ICS) service or operator account from a source Internet Protocol (IP) address outside the approved administrative Classless Inter-Domain Routing (CIDR) subnet, or a sudo/su escalation event by an ICS service account that does not normally require interactive privilege escalation, correlated with subsequent execution of ICS engineering tools. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sudo/su success for Industrial Control Systems (ICS) service account UID without the expected automated invocation pattern"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "syslog:auth",
                    "channel": "sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedAdminCIDR",
                    "description": "IP ranges from which SSH administrative access to ICS Linux assets is authorized."
                },
                {
                    "field": "ApprovedHostList",
                    "description": "Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."
                },
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges from which network device administrative access is authorized."
                },
                {
                    "field": "AuthToDeviceWindow",
                    "description": "Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."
                },
                {
                    "field": "ICSRoleAccountPatterns",
                    "description": "Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."
                },
                {
                    "field": "OfficeHoursWindow",
                    "description": "Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d27cebed-41c5-46b8-8c98-a57d6c40805e",
            "created": "2026-10-13T17:46:02.723Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0772#AN2197",
                    "external_id": "AN2197"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:02.723Z",
            "name": "Analytic 2197",
            "description": "Real-time monitoring identifies remote console or web management sessions to Industrial Control System (ICS) network devices from IP addresses that are not approved  Network Management System (NMS) hosts, where the sessions access device configuration interfaces. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedManagementCIDR",
                    "description": "IP ranges authorized for remote desktop/console access to ICS hosts."
                },
                {
                    "field": "ApprovedOperatorList",
                    "description": "Accounts with documented operator/engineer roles."
                },
                {
                    "field": "ApprovedOperatorWorkstations",
                    "description": "Inventory of workstations from which operator/engineer interactive sessions are expected to originate."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d2a6ecfe-089b-47cc-8f10-260ad2de9c2e",
            "created": "2026-10-13T17:46:03.526Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0789#AN2198",
                    "external_id": "AN2198"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:03.526Z",
            "name": "Analytic 2198",
            "description": "Real-time monitoring identifies ACL modifications on Industrial Control System (ICS) network devices specifically blocking ICS reporting message ports while allowing command ports to remain open. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Device-specific configured interval for unsolicited reporting."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d3adcced-e0c1-4b3c-8a54-f0edd3805df0",
            "created": "2026-10-13T17:45:54.329Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0728#AN2188",
                    "external_id": "AN2188"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:54.329Z",
            "name": "Analytic 2188",
            "description": "Real-time monitoring identifies a network-device ACL, filter, or rate-limit policy change that suppresses or blocks ICS alarm-notification traffic outside the approved network-change baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "AlarmConfigAddressRange",
                    "description": "Protocol register/address ranges corresponding to alarm threshold and configuration values per device type."
                },
                {
                    "field": "AlarmConfigPaths",
                    "description": "File system paths for alarm configuration files/databases on Windows alarm servers."
                },
                {
                    "field": "ApprovedWriteSources",
                    "description": "IP allowlist of sources authorized to write to ICS devices, including alarm configuration."
                },
                {
                    "field": "HMIAlarmParentAllowlist",
                    "description": "Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration."
                },
                {
                    "field": "SuppressGracePeriod",
                    "description": "Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d585c9c1-aa82-4b3c-a42d-eb499d996219",
            "created": "2026-10-13T17:46:31.042Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0789#AN2216",
                    "external_id": "AN2216"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:31.042Z",
            "name": "Analytic 2216",
            "description": "Real-time monitoring identifies a field device ceasing to send expected unsolicited reports or periodic status updates without a corresponding device alarm or maintenance event, while the device remains reachable via direct polling. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "no unsolicited report received from device_ip within 1.5x expected reporting interval, while direct polling confirms device is reachable"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "device_ip generates no outbound unsolicited traffic while responding normally to inbound polls"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Device-specific configured interval for unsolicited reporting."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d5cdbfae-d4c3-4379-9330-de223f74fb09",
            "created": "2026-10-13T17:45:40.579Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0788#AN2177",
                    "external_id": "AN2177"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:40.579Z",
            "name": "Analytic 2177",
            "description": "Real-time monitoring identifies NetFlow showing a source making sequential connections to multiple field device Internet Protocol (IP) addresses, each resulting in large response payloads characteristic of directory listing rather than value reads. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client identities authorized for namespace browsing."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate polling/browsing sources."
                },
                {
                    "field": "NamespaceCoverageThreshold",
                    "description": "Percentage of total device tag/object space accessed within a session constituting full enumeration."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4",
            "created": "2026-10-13T17:47:31.041Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0789#AN2264",
                    "external_id": "AN2264"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:31.041Z",
            "name": "Analytic 2264",
            "description": "Real-time monitoring identifies Windows firewall changes blocking unsolicited Industrial Control System (ICS) reporting traffic while leaving polling/command traffic unaffected, resulting in Supervisory Control and Data Acquisition (SCADA) losing event-driven visibility while retaining polling capability. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f",
                    "name": "WinEventLog:Security",
                    "channel": "Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change blocking unsolicited Industrial Control Systems (ICS) reporting traffic while command/polling traffic continues"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExpectedReportingInterval",
                    "description": "Device-specific configured interval for unsolicited reporting."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--d8aba717-a6a9-4ded-815c-603dd4a44508",
            "created": "2026-10-13T17:46:55.746Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0742#AN2239",
                    "external_id": "AN2239"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:55.746Z",
            "name": "Analytic 2239",
            "description": "Real-time monitoring identifies Open Platform Communications (OPC) Unified Architecture (UA) method invocations or International Electrotechnical Commission (IEC) 61850 Abstract Common Services Interface (ACSI) service requests arriving at a field device from a client identity not in the approved application allowlist, where the invoked method is a write or control operation rather than read/subscribe. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "write/control method invocation from client identity not in approved application list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedApplicationList",
                    "description": "Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."
                },
                {
                    "field": "ApprovedOPCClients",
                    "description": "Allowlist of OPC client application identities authorized to invoke write/control methods."
                },
                {
                    "field": "AuthorizedICSApplications",
                    "description": "Allowlist of process executables permitted to load ICS vendor automation API libraries."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--da7a9116-f290-4160-a24a-930d8961ddf4",
            "created": "2026-10-13T17:46:25.464Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0903#AN2213",
                    "external_id": "AN2213"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:25.464Z",
            "name": "Analytic 2213",
            "description": "Real-time monitoring identifies an abrupt cessation of expected Industrial Control System (ICS) protocol traffic between a Supervisory Control and Data Acquisition (SCADA)/control server and a field device, without a corresponding device alarm or scheduled maintenance event, while the device remains reachable for at least some traffic types. This technique-level analytic synthesizes Command Message blocking (T1691.001) and Reporting Message blocking (T1691.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e",
                    "name": "operationaldb:AlarmEvent",
                    "channel": "expected communication absent for device_ip without corresponding device-generated alarm explaining the gap"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "CommunicationGapThreshold",
                    "description": "Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--dc472b4e-7b39-4bbb-810e-acbf9998a767",
            "created": "2026-10-13T17:46:28.525Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0746#AN2215",
                    "external_id": "AN2215"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:28.525Z",
            "name": "Analytic 2215",
            "description": "Real-time monitoring cross-correlates a field device's reported telemetry against an independent secondary measurement, identifying cases where the reported value diverges from the independent reading while the device's network-layer identity shows a MAC mismatch against its enrolled hardware address. Spoofed reporting messages are, by definition, designed to look protocol-valid. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95",
                    "name": "operationaldb:ProcessHistory",
                    "channel": "reported values show statistically improbable stability during a period when physical process is known to be actively changing"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Flow",
                    "channel": "reporting message for device_ip originates from src_mac not matching enrolled hardware address for that Internet Protocol (IP)"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298",
                    "name": "processsensor:RedundantComparison",
                    "channel": "device-reported value for a tag diverges from independently measured value for same physical quantity by more than sensor tolerance threshold"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "SensorToleranceThreshold",
                    "description": "Acceptable divergence between primary and independent secondary measurement of the same physical quantity."
                },
                {
                    "field": "ZeroVarianceWindow",
                    "description": "Time window over which reported values are checked for implausible stability."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e25f2fd3-1172-447f-8c03-715689666691",
            "created": "2026-10-13T17:44:32.346Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0734#AN2128",
                    "external_id": "AN2128"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:32.346Z",
            "name": "Analytic 2128",
            "description": "Real-time monitoring identifies a scripting interpreter process iterating through Industrial Control System (ICS) data sources and writing output to a local file or piping to a network socket, by a User Identifier (UID) not associated with documented automation scripts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter making sequential Industrial Control Systems (ICS) protocol reads with output to file, by User Identifier (UID) not in authorized scripting UIDs"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedHistorianClients",
                    "description": "Allowlist of applications/accounts authorized to perform bulk historian queries."
                },
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate SCADA/historian servers."
                },
                {
                    "field": "AutoCollectionTimeWindow",
                    "description": "Time window within which sequential reads across multiple devices are considered part of a single automated collection event."
                },
                {
                    "field": "BulkQueryThreshold",
                    "description": "Record count threshold above which a historian query is considered a bulk export rather than a routine query."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e2a6f7a5-8316-4367-8e90-9d6560818250",
            "created": "2026-10-13T17:45:46.790Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0724#AN2182",
                    "external_id": "AN2182"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:46.790Z",
            "name": "Analytic 2182",
            "description": "Real-time monitoring identifies network device management session authentication such as Secure Shell (SSH), Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access-Control System Plus (TACACS+) using valid Industrial Control System (ICS) network administrator credentials but originating from source IPs outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet or at times inconsistent with the account's normal usage pattern, where the session performs configuration changes not reflected in any open change-control ticket. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e",
                    "name": "networkdevice:aaa",
                    "channel": "TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "configuration change logged without corresponding change ticket reference following anomalous authentication"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedAdminCIDR",
                    "description": "IP ranges from which SSH administrative access to ICS Linux assets is authorized."
                },
                {
                    "field": "ApprovedHostList",
                    "description": "Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."
                },
                {
                    "field": "ApprovedNMSCIDR",
                    "description": "IP ranges from which network device administrative access is authorized."
                },
                {
                    "field": "AuthToDeviceWindow",
                    "description": "Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."
                },
                {
                    "field": "ICSRoleAccountPatterns",
                    "description": "Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."
                },
                {
                    "field": "OfficeHoursWindow",
                    "description": "Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--e3b493fc-9771-4e68-b7ec-e91556b22c46",
            "created": "2026-10-13T17:47:50.353Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0781#AN2277",
                    "external_id": "AN2277"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:50.353Z",
            "name": "Analytic 2277",
            "description": "Real-time monitoring identifies an email client or Office application process spawning a script interpreter or shell process on an Industrial Control System (ICS) engineering or operator workstation, immediately following the opening of an email attachment. Documented across multiple ICS incident reports as a primary initial access vector. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=1 parent matches outlook.exe/winword.exe/excel.exe and image matches cmd.exe/powershell.exe/wscript.exe/mshta.exe on host in Industrial Control Systems (ICS) workstation inventory"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of hosts classified as ICS engineering or operator workstations."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ec4eaf43-4490-4833-a18a-e475ab244970",
            "created": "2026-10-13T17:47:16.942Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0803#AN2257",
                    "external_id": "AN2257"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:47:16.942Z",
            "name": "Analytic 2257",
            "description": "Real-time monitoring identifies an SSH authentication/session to an ICS Linux asset from a VPN-assigned or remote-access source outside the approved remote-administration baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b",
                    "name": "syslog:auth",
                    "channel": "Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedRemoteAccessOrigins",
                    "description": "Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."
                },
                {
                    "field": "ExpectedSessionPattern",
                    "description": "Baseline of normal session timing/duration for each ICS-role account's remote access usage."
                },
                {
                    "field": "RemoteAccessToICSWindow",
                    "description": "Time window correlating VPN authentication with subsequent ICS-zone network access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ee51b3ed-fb50-46dc-b21f-d28a98467941",
            "created": "2026-10-13T17:45:57.072Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0738#AN2191",
                    "external_id": "AN2191"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:57.072Z",
            "name": "Analytic 2191",
            "description": "Real-time monitoring identifies network device management commands succeeding from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, following exploit-pattern traffic to the device's management interface, suggesting exploitation of a management-plane vulnerability to gain elevated access without valid credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window within which a device/process crash and subsequent privileged action are considered correlated."
                },
                {
                    "field": "KnownVulnerableDriverSignatures",
                    "description": "Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique)."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119",
            "created": "2026-10-13T17:45:25.620Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0780#AN2167",
                    "external_id": "AN2167"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:25.620Z",
            "name": "Analytic 2167",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) host telemetry gaps -- process lists differing between Windows Management Instrumentation (WMI) and direct enumeration, or unexpected kernel driver loads from unexpected paths -- suggesting kernel-level manipulation of what the Operating System (OS) reports. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "edr:TelemetryCompare",
                    "channel": "process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing"
                },
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03",
                    "name": "WinEventLog:Sysmon",
                    "channel": "EventCode=6 kernel driver load from path not in trusted driver paths, not signed by trusted signer list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "FirmwareIntegrityScanSchedule",
                    "description": "Frequency of out-of-band firmware integrity verification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--efad38ee-8529-4860-9d22-d5a36626cb2d",
            "created": "2026-10-13T17:44:35.996Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0738#AN2131",
                    "external_id": "AN2131"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:35.996Z",
            "name": "Analytic 2131",
            "description": "Real-time monitoring identifies a process owned by an Industrial Control System (ICS) service User Identifier (UID) executing a Set User Identifier (SUID) binary or exploiting a kernel vulnerability to obtain root privileges, detected via unexpected setuid/setgid syscalls from a process not invoked via sudo. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window within which a device/process crash and subsequent privileged action are considered correlated."
                },
                {
                    "field": "KnownVulnerableDriverSignatures",
                    "description": "Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique)."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f17cd473-1711-4a92-b8c7-a9890d432032",
            "created": "2026-10-13T17:45:02.717Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0792#AN2151",
                    "external_id": "AN2151"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:02.717Z",
            "name": "Analytic 2151",
            "description": "Real-time monitoring identifies a Linux process opening Industrial Control System (ICS) protocol master connections to multiple field device Internet Protocol (IP) addresses, from a host that is not the authorized Supervisory Control and Data Acquisition (SCADA) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP/identity allowlist of legitimate master/control server systems."
                },
                {
                    "field": "RegisteredMasterAddresses",
                    "description": "Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."
                },
                {
                    "field": "RogueMasterTimeWindow",
                    "description": "Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f45c158a-7086-4172-9fe4-1684e0ca34ee",
            "created": "2026-10-13T17:45:50.059Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0780#AN2185",
                    "external_id": "AN2185"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:50.059Z",
            "name": "Analytic 2185",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) network device telemetry gaps -- Simple Network Management Protocol (SNMP) polling returning inconsistent results, syslog sequence gaps -- suggesting kernel-level manipulation of device-reported state. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:snmp",
                    "channel": "Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "FirmwareIntegrityScanSchedule",
                    "description": "Frequency of out-of-band firmware integrity verification."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f4abf9a4-ce83-41cf-85e2-a823d46ebf10",
            "created": "2026-10-13T17:48:07.198Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0767#AN2288",
                    "external_id": "AN2288"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:48:07.198Z",
            "name": "Analytic 2288",
            "description": "Real-time monitoring identifies exploit-pattern ICS/network traffic, including malformed packets, out-of-spec function codes, or overflow-sized payloads, targeting ICS servers or field devices from unexpected sources. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "zeek:conn",
                    "channel": "exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate connections to network-facing ICS services are expected."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f571ba94-73ab-4590-ba2c-739a93cde075",
            "created": "2026-10-13T17:44:57.810Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0782#AN2147",
                    "external_id": "AN2147"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:44:57.810Z",
            "name": "Analytic 2147",
            "description": "Real-time monitoring identifies a browser process on an Industrial Control System (ICS) Linux workstation spawning child processes that execute with arguments inconsistent with normal browsing, or writing binaries to /tmp or user home directories. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Linux"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
                    "name": "auditd:SYSCALL",
                    "channel": "Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; browser process spawns a command shell, script interpreter, or executable child inconsistent with the approved browser-child baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of ICS engineering/operator workstations from which routine vendor software downloads occur."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f91f4654-219f-47a4-aa5a-7c1597f23908",
            "created": "2026-10-13T17:46:50.572Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0740#AN2235",
                    "external_id": "AN2235"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:50.572Z",
            "name": "Analytic 2235",
            "description": "Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded device's management web interface containing exploit-pattern content (oversized parameters, directory traversal sequences) from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedClientCIDR",
                    "description": "IP ranges from which legitimate access to the ICS web interface is expected."
                },
                {
                    "field": "ExploitPatternSignatures",
                    "description": "Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."
                },
                {
                    "field": "ExploitToShellWindow",
                    "description": "Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--f95ebff8-48ae-409a-adfb-8230d870768b",
            "created": "2026-10-13T17:46:39.740Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0799#AN2223",
                    "external_id": "AN2223"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:39.740Z",
            "name": "Analytic 2223",
            "description": "Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "NSM:Connections",
                    "channel": "Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedVendorDomains",
                    "description": "Allowlist of legitimate vendor/business domains for application-layer protocol traffic."
                },
                {
                    "field": "NoExternalConnectivityRoleList",
                    "description": "Inventory of ICS hosts whose role does not require external application-layer connectivity."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--fde26204-97d9-4635-82c4-c7e3ed3c9a2c",
            "created": "2026-10-13T17:46:57.442Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0781#AN2241",
                    "external_id": "AN2241"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:57.442Z",
            "name": "Analytic 2241",
            "description": "Real-time monitoring identifies an Industrial Control System (ICS) field device or embedded engineering terminal receiving malformed or exploit-payload data via its built-in communication interface from an external source, designed to exploit a vulnerability in the device's communication stack. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Embedded"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c",
                    "name": "NSM:Content",
                    "channel": "malformed or exploit-payload data via built-in communication interface from external source"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ICSWorkstationInventory",
                    "description": "Inventory of hosts classified as ICS engineering or operator workstations."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--fe1b5de5-3919-480b-80b6-8914b6b1d098",
            "created": "2026-10-13T17:46:04.726Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0795#AN2199",
                    "external_id": "AN2199"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:46:04.726Z",
            "name": "Analytic 2199",
            "description": "Real-time monitoring identifies Industrial Control System (ICS) network device syslog recording unexpected restarts or crashes coinciding with anomalous traffic patterns on management interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa",
                    "name": "networkdevice:syslog",
                    "channel": "unexpected restart or crash coinciding with anomalous traffic pattern on management interface"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ExploitCrashCorrelationWindow",
                    "description": "Time window correlating a memory access event with a subsequent crash."
                },
                {
                    "field": "TrustedSecurityToolList",
                    "description": "Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "x-mitre-analytic",
            "spec_version": "2.1",
            "id": "x-mitre-analytic--ff0f3e46-3817-4b77-a188-74720d721c03",
            "created": "2026-10-13T17:45:45.940Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/detectionstrategies/DET0907#AN2181",
                    "external_id": "AN2181"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-13T17:45:45.940Z",
            "name": "Analytic 2181",
            "description": "Real-time monitoring identifies a host generating rapid, sequential Transmission Control Protocol (TCP) connection attempts across multiple destination ports on Industrial Control System (ICS) device Internet Protocol (IP) addresses, targeting ICS-specific protocol ports, from a source not in the approved control server inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "3.3.0",
            "x_mitre_domains": [
                "ics-attack"
            ],
            "x_mitre_platforms": [
                "Network Devices"
            ],
            "x_mitre_log_source_references": [
                {
                    "x_mitre_data_component_ref": "x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a",
                    "name": "netflow:ipfix",
                    "channel": "IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers"
                }
            ],
            "x_mitre_mutable_elements": [
                {
                    "field": "ApprovedSCADAServers",
                    "description": "IP allowlist of legitimate sources."
                },
                {
                    "field": "PortScanTimeWindow",
                    "description": "Time window within which connections across multiple ports are considered a single scan event."
                }
            ],
            "x_mitre_deprecated": false
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--004d6d78-390b-4969-9e88-8b92d33fbfc0",
            "created": "2023-09-28T21:09:50.956Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.903Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--007a2c53-fc5c-4750-aff0-defb282e178a",
            "created": "2023-09-29T16:30:30.829Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.903Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--008c7424-73ef-4a99-bcfa-2d96eb7daba0",
            "created": "2026-04-22T20:41:47.703Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.903Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--00b9e63b-57a7-408e-83d6-fc03535010a6",
            "created": "2023-09-27T14:39:33.141Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.609Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) used Valid Accounts taken from the Windows Domain Controller to access the control system Virtual Private Network (VPN) used by grid operators. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--00cc557e-e1a7-4fdd-b626-2efc73fe510b",
            "created": "2026-09-25T18:41:20.247Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:41:20.247Z",
            "description": "Require signed PowerShell scripts where operationally feasible and restrict execution of unsigned or untrusted scripts on ICS Windows assets. Maintain explicit exceptions for validated vendor and engineering automation. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--00e34880-abdb-418d-9252-0433aa40950e",
            "created": "2026-04-22T15:09:56.165Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:55.792Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--6f318bab-df4a-4a51-b849-e9c2ab2f9c4c",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--00e6c22b-9275-4039-b6d4-2ac0680325d6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.904Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0105c4f6-a34f-4e0e-964b-a7d108ea3e08",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.904Z",
            "description": "Ensure devices have an alternative method for communicating in the event that a valid COM port is unavailable.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--011f1d16-c9f1-48ac-94f1-165466c155f8",
            "created": "2023-09-29T18:43:33.176Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.904Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--012fd76f-1a10-4e48-9306-10ffae3f61dd",
            "created": "2023-09-29T16:30:58.431Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.195Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01335508-22bb-4185-a7e2-49ec9bee6423",
            "created": "2023-09-28T20:15:20.293Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.904Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01914eb7-9c43-4170-9f0e-f7c2a2c4d396",
            "created": "2026-09-26T03:00:41.787Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:00:41.787Z",
            "description": "Use network security controls to identify and, where operationally safe, block DNS tunneling, unauthorized resolver use, suspicious DoH/DoT destinations, and known malicious DNS infrastructure at controlled ICS egress points.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01b4a92f-da42-4dfa-8d59-53709b65940e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.905Z",
            "description": "Limit privileges of user accounts and groups so that only authorized administrators can change service states and configurations.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01c8cc53-dfd0-4afc-8df6-e57494bd9e24",
            "created": "2026-04-22T16:04:03.195Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.905Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--02117d44-46d2-41f0-a5fb-ba303e6ee124",
            "created": "2023-09-29T18:55:47.037Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.906Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--02186089-b30c-4bb7-8c0f-baae4959e3c1",
            "created": "2026-10-07T21:53:56.870Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:53:56.870Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--026ba3e5-ae3b-4a8b-83c0-ea8327cd9e50",
            "created": "2023-09-29T17:42:44.516Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.906Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--028a3bcc-f299-4061-a0f2-8da85e0a3c81",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.906Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--02f547fd-2565-4130-a4be-c4ba7b5aeb0c",
            "created": "2023-09-29T17:59:31.091Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.907Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03181dba-035f-45e6-a5c9-70d02a96e4f4",
            "created": "2025-09-24T18:21:15.104Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.907Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03709641-2bf2-406a-9567-ccf9d0b65017",
            "created": "2025-09-29T22:06:21.839Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03a9cdc7-3cc5-43e3-9a9c-97d1c4310e35",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03aab956-54f3-4e4b-93a7-6d1898d91b57",
            "created": "2023-09-29T16:29:03.438Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03b4dae7-3b20-4ea9-9f7c-6c97582f98b7",
            "created": "2024-03-28T14:33:00.899Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Triton-EENews-2017",
                    "description": "Blake Sobczak. (2019, March 7). The inside story of the world’s most dangerous malware. Retrieved March 25, 2024.",
                    "url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.113Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) changed phone numbers tied to certain specific accounts in a designated contact list. They then used the changed phone numbers to redirect network traffic to websites controlled by them, thereby allowing them to capture and use any login codes sent to the devices via text message.(Citation: Triton-EENews-2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03d44496-7a15-4e23-820f-b6f1079dbbd3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "description": "A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03e1fcda-2007-43f2-aeea-656d3ac13f13",
            "created": "2026-10-07T21:46:10.287Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:46:10.287Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03e80e3c-28b9-4e7f-8b17-7c86d1483b91",
            "created": "2023-03-30T19:00:12.380Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "description": "Information which is sensitive to the operation and architecture of the process environment may be encrypted to ensure confidentiality and restrict access to only those who need to know. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--03e94c12-cd51-4f39-a33d-c66a31bbf361",
            "created": "2023-09-29T17:40:34.866Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.908Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0406292e-1288-42ac-b74b-88f5f0a7f1b9",
            "created": "2025-09-24T18:03:25.211Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.909Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--042243fd-bfe0-4961-96de-a36232d3ff74",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec Security Response July 2014",
                    "description": "Symantec Security Response 2014, July 7 Dragonfly: Cyberespionage Attacks Against Energy Suppliers Retrieved. 2016/04/08 ",
                    "url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers#:~:text=The%20attackers%2C%20known%20to%20Symantec,supply%20in%20the%20affected%20countries."
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.307Z",
            "description": "[Dragonfly](https://attack.mitre.org/groups/G0035) utilized watering hole attacks on energy sector websites by injecting a redirect iframe to deliver [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) or [Trojan.Karagany](https://attack.mitre.org/software/S0094). (Citation: Symantec Security Response July 2014)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--046ca7d3-d2d2-458b-bce4-236bc0f207e5",
            "created": "2026-04-22T22:30:00.729Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.909Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--04882fef-2a6b-40d0-a101-da9c76a3572e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.909Z",
            "description": "Restrict the use of untrusted or unknown libraries, such as remote or unknown DLLs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--2ab9fc6d-3cf6-4d7b-85f1-3ad6949233b3",
            "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0491ef92-2941-4841-9fe6-2e1809788b52",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.909Z",
            "description": "Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--04aad4a8-8b8c-45d9-bb34-508fe4792863",
            "created": "2023-09-28T20:29:11.776Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.909Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--04bf72de-75ba-4d95-ad24-f93ad835180c",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.910Z",
            "description": "[KillDisk](https://attack.mitre.org/software/S0607) erases the master boot record (MBR) and system logs, leaving the system unusable. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0525121a-0797-4353-98d0-7efc65793157",
            "created": "2026-04-22T20:41:30.328Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.910Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--052da7dd-e7c9-4ab3-a8f9-eb734b24ec60",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--0f2e4927-401d-430e-96ed-90feb8df1b03",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--058396ca-3af4-444b-b261-74485c47e68c",
            "created": "2017-05-31T21:33:27.074Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.911Z",
            "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--05d18e5c-9c1f-4ee3-95a2-da62bf1c45f8",
            "created": "2026-04-23T00:28:51.179Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.911Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--05e82fa8-d762-4b8f-ae07-019e0f24100b",
            "created": "2023-09-29T16:43:28.841Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.911Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--061271f5-0d51-4011-9451-532cd1efedbd",
            "created": "2026-04-23T14:20:03.889Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos-Pipedream",
                    "description": "DRAGOS. (2022, April 13). Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.911Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can perform a UDP multicast scan of UDP port 27127 to identify Schneider PLCs that use that port for the NetManage protocol.(Citation: Dragos-Pipedream)(Citation: Wylie-22)\n",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--06257ee1-286f-434f-84b0-f1c083d12e69",
            "created": "2026-10-07T21:56:08.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:56:08.305Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--064dfd6f-db5d-48e8-b350-9dd47a270911",
            "created": "2022-09-28T20:22:09.916Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.912Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can remotely read the OCP UA structure from devices.(Citation: CISA-AA22-103A) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0665de34-d5a5-46ae-a0e5-3021bf48c294",
            "created": "2026-04-20T20:54:17.554Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:17.554Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--067932c3-0011-4ca2-9bbe-721c631e4e41",
            "created": "2021-04-13T12:45:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                },
                {
                    "source_name": "ICS-CERT August 2018",
                    "description": "ICS-CERT 2018, August 22 Advisory (ICSA-14-178-01) Retrieved. 2019/04/01 ",
                    "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.912Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) payload gathers server information that includes CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth. This information helps indicate the role the server has in the control process. (Citation: ICS-CERT August 2018) (Citation: Daavid Hentunen, Antti Tikkanen June 2014)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--06c663f8-fcf1-47eb-ab79-284e93eafa6b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.912Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0750563d-a86c-4822-ab9c-0f2d3c304c6e",
            "created": "2023-09-28T21:28:51.104Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.913Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--076bfea6-309e-4804-a147-dffe93983481",
            "created": "2023-09-28T20:16:17.295Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.913Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--077226fd-25b1-4d77-b2e5-d81331ff803b",
            "created": "2025-09-29T19:02:12.939Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.913Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--079705ab-c377-4a5b-b9f3-70ed03419ee2",
            "created": "2023-09-29T17:09:59.595Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.914Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--079dfa0e-16b1-4d5a-a548-46b53de7cd61",
            "created": "2026-04-22T16:36:52.234Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.914Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--07ccd2e1-d4fa-44ff-8d42-95a0942f89d6",
            "created": "2023-03-10T20:35:16.772Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.157Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--07e06d21-e666-4274-838a-ef9996fdc0cd",
            "created": "2023-09-28T20:05:45.540Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.731Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--07f11dc3-60d7-42d3-a4f0-82eba85dfe44",
            "created": "2023-09-29T16:47:20.192Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.914Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--07f4d65d-4572-450f-8cb2-908fee97bd67",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.914Z",
            "description": "Application control may be able to prevent the running of executables masquerading as other files.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--08302021-aacf-428f-a0ce-e1034d925fb0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.914Z",
            "description": "Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d48b79b2-076d-483e-949c-0d38aa347499",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--085c2906-24e2-4bc8-8e5d-fded599d798c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.915Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--085ccfd8-ef5f-41cb-abc7-be5330c60f4e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--b04e83cc-8ace-4880-8953-7ce55eb8c427",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0861bf03-eadd-45a4-8490-ae2a2939125b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--a366d027-d797-4957-949a-870aed0766dd",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--095456bc-898b-4c76-a062-ff0ea90aeab4",
            "created": "2023-09-28T21:25:05.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.916Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--09676502-c50a-47ca-bbef-fffced52346e",
            "created": "2026-04-23T00:09:58.357Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:54.245Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--2e99cd65-aad4-4796-9013-79837d498eb6",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--096c3136-dac9-4729-98c0-c8d870f2bd13",
            "created": "2023-09-28T19:42:01.055Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.916Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--096e7743-c090-4386-a759-d749f00bae61",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.916Z",
            "description": "Review vendor documents and security alerts for potentially unknown or overlooked default credentials within existing devices.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--098ea270-0a22-4922-a585-412d8ee78390",
            "created": "2026-04-22T20:41:09.962Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.916Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--09a96454-505b-4e05-bc0d-41bf791dc926",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--edf989d8-7e25-4ed2-b289-a55dee68a75e",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--09e0c991-1707-431b-a0fd-fd8215e6d552",
            "created": "2023-09-28T20:30:12.291Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.917Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--09e9ed5d-bf32-4aee-8441-774e21ffbdb6",
            "created": "2023-09-28T19:53:56.266Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.917Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0a3b621d-2e88-4392-9963-3fdc40d3cb42",
            "created": "2025-09-29T22:03:02.738Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.917Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0a421699-f013-49f4-9d9f-01d95d210510",
            "created": "2023-09-28T19:37:25.214Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.917Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0a5d2136-e1f5-4a54-be64-a558f918bf0d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.349Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0aefda29-be77-4660-b7a5-a6430f409914",
            "created": "2023-10-02T20:18:20.019Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.918Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0afaef8a-ed55-4a5b-bbbb-0671a8ffaa79",
            "created": "2023-09-29T18:42:27.894Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.918Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0b2a6fc5-3416-4d78-96cb-f6325c91ab91",
            "created": "2023-10-02T20:23:11.865Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.918Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0b2d0517-9943-413e-a6f9-30c6d5ce8c42",
            "created": "2023-09-28T19:59:10.561Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.918Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0b4198f1-e32d-4430-af65-893d3007be7f",
            "created": "2026-04-22T16:09:16.900Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.919Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0b6cd19f-ee13-4224-9e22-f8a9e626d98f",
            "created": "2023-09-28T21:22:48.239Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.919Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ba1db3a-389a-4937-975b-d2dc0142cb4b",
            "created": "2023-09-29T18:46:22.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.919Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0bc90405-24a9-4f84-a1bb-bf953dbca016",
            "created": "2023-09-28T20:10:34.479Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.919Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0bdfc1b0-3dd2-4170-a39e-98675202a6d2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.919Z",
            "description": "Filter for protocols and payloads associated with firmware activation or updating activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0beb0088-3bea-4612-b2d9-ff9988f829ae",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jacqueline O'Leary et al. September 2017",
                    "description": "Jacqueline O'Leary et al. 2017, September 20 Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware Retrieved. 2019/12/02 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
                },
                {
                    "source_name": "Junnosuke Yagi March 2017",
                    "description": "Junnosuke Yagi 2017, March 07 Trojan.Stonedrill Retrieved. 2019/12/05 ",
                    "url": "https://www.symantec.com/security-center/writeup/2017-030708-4403-99"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:52.967Z",
            "description": "[APT33](https://attack.mitre.org/groups/G0064) utilize backdoors capable of capturing screenshots once installed on a system. (Citation: Jacqueline O'Leary et al. September 2017)(Citation: Junnosuke Yagi March 2017)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
            "target_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c145fb9-b67d-41ef-94a8-8bd3a5eabd3e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--cb273244-c117-4e32-afc7-f72f4e44e179",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c1fe5fc-3bdc-4d0e-94a0-6564f2ce4444",
            "created": "2017-05-31T21:33:27.074Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov October 2017",
                    "description": "Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov 2017, October 27 Bad Rabbit Ransomware Retrieved. 2019/10/27 ",
                    "url": "https://securelist.com/bad-rabbit-ransomware/82851/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.920Z",
            "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) ransomware spreads through drive-by attacks where insecure websites are compromised. While the target is visiting a legitimate website, a malware dropper is being downloaded from the threat actors infrastructure. (Citation: Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov October 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c27087a-623e-4c22-91ce-aa86ea57d7ab",
            "created": "2025-09-24T18:19:10.881Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.920Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c68501b-8e36-4d75-9e61-7a518a9ca1f2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.920Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c72593d-fcc6-4023-8771-bed5e243310e",
            "created": "2023-09-28T21:24:37.417Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.920Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0c7fc84c-ae9f-4359-9570-f3e5faeb0883",
            "created": "2026-10-07T20:34:06.665Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:34:06.665Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0cce4090-d079-422c-995e-b4f04b280a7d",
            "created": "2025-09-29T19:08:40.214Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0cd64563-f35e-4cb3-94b9-617c868d3671",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ce4ccc4-4e9e-4a4b-86d4-3c3838229c3d",
            "created": "2026-04-22T22:29:43.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d379c02-d3bb-4698-b30c-985705a9bfd7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--05f7d4e4-ae99-4339-b71a-59f1e317dc6d",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d4f2f88-e176-42c7-8258-52b345045662",
            "created": "2022-09-28T20:29:51.844Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can remotely send commands to a malicious agent uploaded on Omron PLCs over HTTP or HTTPS.(Citation: CISA-AA22-103A) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d52eea3-394e-492b-944b-9ccb6348329d",
            "created": "2023-09-28T21:14:41.633Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d537021-040f-4592-a3e0-006be5502615",
            "created": "2026-04-22T22:49:50.189Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d563cbc-b22c-4748-b082-db98bb7f0dab",
            "created": "2024-11-20T23:08:24.321Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                },
                {
                    "source_name": "Nozomi BUSTLEBERM 2024",
                    "description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
                    "url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.921Z",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) allows for the modification of system settings by reading and writing to registers via Modbus commands.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d8e0324-ba8e-4712-a123-60377afe94da",
            "created": "2023-09-29T18:48:17.073Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0d985b02-cf5f-4307-92ef-9b45eb41bb1b",
            "created": "2026-04-23T00:32:54.549Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:57.691Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--e90f1c0c-f2c5-4fe1-942f-411574df043f",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0dbf48f3-4579-4ca2-aceb-19d3e0449136",
            "created": "2023-09-29T17:57:12.010Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0dd31d16-9111-4016-9ebb-412eb577fb79",
            "created": "2026-09-25T20:34:46.230Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:34:46.230Z",
            "description": "Use application control and macro/script restrictions to prevent unapproved VBS/VBA/VBScript execution, while explicitly allowlisting required vendor macros and engineering automation. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0df0cb6d-0067-48b2-a33e-495415713ab7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e0eed7f-1569-4596-9931-bca61a35dc3b",
            "created": "2025-09-29T21:59:48.001Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e191d66-fe38-4f28-ad82-6922bd6bcc81",
            "created": "2024-04-09T20:58:17.933Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e29f62d-4ffc-47ec-9623-72f874fbe905",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.922Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) renames s7otbxdx.dll, a dll responsible for handling communications with a PLC. It replaces this dll file with its own version that allows it to intercept any calls that are made to access the PLC. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e2b2bef-d9d5-436e-84d5-ffbad6653c80",
            "created": "2026-10-07T20:07:56.746Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:07:56.746Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e4f272b-d744-4feb-9f3f-c24c3598538f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.923Z",
            "description": "Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3222a807-521b-4a1a-aa13-f1cda45734b3",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e9d5ca1-5bb1-415f-b31b-d4187d58f4ae",
            "created": "2025-09-29T19:07:47.713Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.924Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e9d621b-7d0b-4490-b46f-2a671abca251",
            "created": "2026-04-22T21:40:02.113Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.924Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0eb112f6-c1cb-4843-93f5-f668aa0e9bd8",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos",
                    "description": "Dragos   Allanite Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/resource/allanite/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:27.988Z",
            "description": "[ALLANITE](https://attack.mitre.org/groups/G1000) utilized credentials collected through phishing and watering hole attacks. (Citation: Dragos)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ef1e408-8ebb-4b28-b619-02914b7bae29",
            "created": "2023-09-29T17:57:34.378Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.924Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f18b876-b698-4f70-aa98-50e8b5a7eae2",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Andy Greenburg June 2019",
                    "description": "Andy Greenburg 2019, June 20 Iranian Hackers Launch a New US-Targeted Campaign as Tensions Mount Retrieved. 2020/01/03 ",
                    "url": "https://www.wired.com/story/iran-hackers-us-phishing-tensions/"
                },
                {
                    "source_name": "Jacqueline O'Leary et al. September 2017",
                    "description": "Jacqueline O'Leary et al. 2017, September 20 Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware Retrieved. 2019/12/02 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:52.976Z",
            "description": "[APT33](https://attack.mitre.org/groups/G0064) sent spear phishing emails containing links to HTML application files, which were embedded with malicious code. (Citation: Jacqueline O'Leary et al. September 2017) [APT33](https://attack.mitre.org/groups/G0064) has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies. (Citation: Andy Greenburg June 2019)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f20baa2-20cd-49de-bfa4-5b9765ceacf1",
            "created": "2025-09-29T19:47:19.964Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.924Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f41614d-c37c-47d1-9616-6dae9b73b532",
            "created": "2026-04-22T17:51:17.695Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.924Z",
            "description": "Allow for code signing of any project files stored at rest to prevent unauthorized tampering. Ensure the signing keys are not easily accessible on the same system.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f5295ce-d705-4541-8dda-c569b126d103",
            "created": "2023-10-02T20:24:03.723Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f5710a7-f015-40b8-ad3d-f281699f2b72",
            "created": "2023-09-29T17:09:11.210Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f7a9b56-e3b4-4cc9-9ea7-32faebad74b6",
            "created": "2026-04-22T17:59:09.398Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Aditya K Sood July 2019",
                    "description": "Aditya K Sood 2019, July Discovering and fingerprinting BACnet devices Retrieved. 2020/09/25 ",
                    "url": "https://www.helpnetsecurity.com/2019/07/10/bacnet-devices/"
                },
                {
                    "source_name": "Colin Gray",
                    "description": "Colin Gray D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25  How SDN Can Improve Cybersecurity in OT Networks Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6891_HowSDN_CG_20180720_Web2.pdf?v=20190312-231901"
                },
                {
                    "source_name": "D. Parsons and D. Wylie September 2019",
                    "description": "D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25 ",
                    "url": "https://www.csiac.org/journal-article/practical-industrial-control-system-ics-cybersecurity-it-and-ot-have-converged-discover-and-defend-your-assets/"
                },
                {
                    "source_name": "Josh Rinaldi April 2016",
                    "description": "Josh Rinaldi 2016, April Still a Thrill: OPC UA Device Discovery Retrieved. 2020/09/25 ",
                    "url": "https://www.rtautomation.com/rtas-blog/still-a-thrill-opc-ua-device-discovery/"
                },
                {
                    "source_name": "Langner November 2018",
                    "description": "Langner 2018, November Why Ethernet/IP changes the OT asset discovery game Retrieved. 2020/09/25 ",
                    "url": "https://www.langner.com/2018/11/why-ethernet-ip-changes-the-ot-asset-discovery-game/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "description": "ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.(Citation: D. Parsons and D. Wylie September 2019)(Citation: Colin Gray) Examples of automation protocols with discovery capabilities include OPC UA Device Discovery(Citation: Josh Rinaldi April 2016), BACnet(Citation: Aditya K Sood July 2019), and Ethernet/IP.(Citation: Langner November 2018)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0f8a6c14-1050-404a-bb6e-4fe107d5b6cd",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "description": "Devices should authenticate all messages between master and outstation assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0fd7d59d-9622-41c0-8e41-4ac4d1ac6655",
            "created": "2023-09-28T19:56:40.730Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ff88ef7-44fd-4307-b381-2e0bc76ce83b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "description": "Ensure proper network segmentation between higher level corporate resources and the control process environment.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ff9310f-6e24-4ad4-b704-8562f7b1b981",
            "created": "2026-09-26T01:53:21.025Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:53:21.025Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) communicates with Triconex controllers using a custom component framework written entirely in Python. The modules that implement the TriStation communication protocol and other supporting components are found in a separate file -- library.zip -- the main script that employs this functionality is compiled into a standalone py2exe Windows executable -- trilog.exe  which includes a Python environment.(Citation: DHS CISA February 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0ffdee1a-1e83-4506-aba2-38c55812abb3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "description": "Ensure that all SIS are segmented from operational networks to prevent them from being targeted by additional adversarial behavior.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--da44255d-85c5-492c-baf3-ee823d44f848",
            "target_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--10022aa8-b77b-4173-bcea-bc92d2b9f756",
            "created": "2026-04-22T18:59:05.627Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.925Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--10118728-17b8-41a2-b4d6-d8661bc177df",
            "created": "2025-09-29T19:06:51.691Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.926Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--102553a8-d57d-4946-a9f0-086ef1683e1d",
            "created": "2026-04-22T22:32:16.270Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.926Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--10346185-5437-4317-a9f9-88561a8a1f08",
            "created": "2026-10-07T17:50:45.384Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:50:45.384Z",
            "description": "Disable or remove JavaScript/JScript execution surfaces that are not required for the documented role of an ICS asset, while preserving validated HMI, vendor, and engineering dependencies.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--104b4f25-d0a9-41f6-94b3-fa85ee8b1523",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.926Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--10626671-941d-4a82-a835-56059058ef87",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.926Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--106530e1-375a-4ac4-befb-8297b3b05610",
            "created": "2023-09-29T18:55:58.199Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.378Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--107d9a23-991b-44f5-97f6-7f6983c7013a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.926Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--10b66db6-5b3d-4b75-b30e-e65a67366462",
            "created": "2026-09-25T20:33:36.654Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:33:36.654Z",
            "description": "Apply exploit-protection controls to Windows applications capable of invoking VBA/VBScript, particularly Office and legacy applications present on ICS overlap assets, after compatibility testing. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--111f437a-c67d-40e4-9515-7e9b22e65eff",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Microsoft May 2017",
                    "description": "Microsoft 2017, May Attractive Accounts for Credential Theft Retrieved. 2020/09/25 ",
                    "url": "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/attractive-accounts-for-credential-theft"
                },
                {
                    "source_name": "Microsoft August 2018",
                    "description": "Microsoft 2018, August Implementing Least-Privilege Administrative Models Retrieved. 2020/09/25 ",
                    "url": "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
                },
                {
                    "source_name": "Microsoft February 2019",
                    "description": "Microsoft 2019, February Active Directory administrative tier model Retrieved. 2020/09/25 ",
                    "url": "https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.927Z",
            "description": "Audit domain and local accounts and their permission levels routinely to look for situations that could allow an adversary to gain system wide access with stolen privileged account credentials. (Citation: Microsoft May 2017) (Citation: Microsoft August 2018)These audits should also identify if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft February 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--112ef370-9936-4c3a-9faf-2861600500bd",
            "created": "2025-09-29T22:06:41.935Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.927Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--11840b30-f0d1-4df5-a960-cdb80749c32a",
            "created": "2023-09-29T17:07:25.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.210Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--119aea8f-443f-4831-8143-ec6cd43021cb",
            "created": "2026-04-20T20:58:48.359Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:48.359Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--11a82651-4d69-4738-89c6-17d0243cbbb0",
            "created": "2023-09-29T17:37:26.536Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.928Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--11b201bc-675b-46ac-89a6-80f90deecc12",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--2a1619a7-dd27-48e4-b56f-806cb3d2e405",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--11e4eb54-b0b3-4f67-a93f-28cc10df00ab",
            "created": "2021-04-13T12:28:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ben Hunter and Fred Gutierrez July 2020",
                    "description": "Ben Hunter and Fred Gutierrez 2020, July 01 EKANS Ransomware Targeting OT ICS Systems Retrieved. 2021/04/12 ",
                    "url": "https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems"
                },
                {
                    "source_name": "Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020",
                    "description": "Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly 2020, July 15 Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT Retrieved. 2021/04/12 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.928Z",
            "description": "Before encrypting the process, [EKANS](https://attack.mitre.org/software/S0605) first kills the process if its name matches one of the processes defined on the kill-list.  (Citation: Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020) (Citation: Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020) EKANS also utilizes netsh commands to implement firewall rules that blocks any remote communication with the device. (Citation: Ben Hunter and Fred Gutierrez July 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--128de3f9-df58-4122-9523-0ac65a6ebf71",
            "created": "2023-09-29T17:45:20.237Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.929Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--129a4d3f-fa4a-42c3-833e-8f15155b9693",
            "created": "2022-03-09T23:42:34.056Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Secureworks IRON VIKING ",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:32.638Z",
            "description": "(Citation: Secureworks IRON VIKING )",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--12a6c5bc-c685-4249-b8c6-e6d49aa2b9ed",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.929Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--12d6fc4f-bf06-4146-a387-4cb86f0f44a4",
            "created": "2023-09-28T21:13:23.057Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.930Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--12e84466-fb05-4d55-9220-5933ee0fcb43",
            "created": "2024-11-20T23:16:42.816Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.499Z",
            "description": "[FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) used [FrostyGoop](https://attack.mitre.org/software/S1165) to manipulate OT devices to induce a district heating disruption in Ukraine.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "target_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--12fdacea-28f7-4113-ae67-0b19e1ab5e36",
            "created": "2023-09-28T19:39:58.335Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.930Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--135b08ae-715b-4f45-9f03-0d156547e09b",
            "created": "2025-09-24T18:18:19.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.930Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--137ce4a2-be4c-4eb7-b92c-d686fa2a1044",
            "created": "2026-04-23T00:04:33.425Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.930Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13809e98-1d74-4c39-b882-9d523c76cbde",
            "created": "2021-04-13T12:36:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.931Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009)'s imain.bin payload takes commands from the TsHi.ExplReadRam(Ex), TsHi.ExplWriteRam(Ex) and TsHi.ExplExec functions to perform operations on controller memory and registers using syscalls written in PowerPC shellcode. (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13a0693c-6297-4221-babc-c8cfce904b13",
            "created": "2026-09-25T20:12:44.653Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:12:44.653Z",
            "description": "Restrict interactive and scripted shell execution on Linux, network, and embedded ICS assets to approved accounts, management paths, commands, and vendor workflows. Where full application control is unavailable, constrain SSH/Telnet access and privileged shell use to dedicated administration paths. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13cfe7cd-6ee4-4d8c-8c3e-b115686b7da7",
            "created": "2026-04-22T21:39:01.006Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.931Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13d76624-7049-45c5-94d3-8f172b7f6336",
            "created": "2023-09-27T14:48:58.922Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.759Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) established an internal proxy prior to the installation of backdoors within the network. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--14055bc9-dc7c-47db-b541-77d05d486018",
            "created": "2023-09-29T17:57:55.162Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.931Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--14178a60-b894-4186-b83b-5ffd043f4cfc",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--709e05b2-6400-43a2-9bbf-b64f6017b023",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1429cd78-4e2a-4898-a7d8-d01a0c465bd6",
            "created": "2023-10-02T20:24:12.666Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.931Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--144f6ce7-d2b2-4a76-85d2-251191a0d2cc",
            "created": "2023-09-29T16:32:33.078Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.932Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--14c73603-a6d2-4a8d-9904-0f8249aaa495",
            "created": "2023-09-29T16:40:06.079Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.779Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--152dbbf5-b069-4784-aabd-c50e2fd6bd53",
            "created": "2026-04-22T22:51:33.389Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.933Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1531a280-e280-465c-826d-ce357935a89c",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ec442b22-3dc8-4b2b-8294-b76b0f01d748",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--15377914-bf08-4c7e-ab00-1e272e2f3c1a",
            "created": "2023-09-28T19:47:25.303Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.933Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1582107d-95dd-41ba-b2c0-72200b93a292",
            "created": "2026-04-22T20:17:49.689Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.449Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries changed the login password of Moxa NPort Serial Device Servers to impede system recovery.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--159fb736-ba92-4564-aa6d-db6f64497763",
            "created": "2023-09-28T20:25:59.717Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.933Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--165e3427-8738-4a89-9964-4593c671e855",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--b817139c-2941-4523-bfb5-10c36d230871",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1673b2e2-7799-4b5f-b5a9-2c51426a6916",
            "created": "2024-03-25T20:10:21.706Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jamie Tarabay and Katrina Manson December 2023",
                    "description": "Jamie Tarabay and Katrina Manson. (2023, December 22). Iranian-Linked Hacks Expose Failure to Safeguard US Water System. Retrieved March 25, 2024.",
                    "url": "https://www.bloomberg.com/news/articles/2023-12-22/iranian-linked-hacks-expose-failure-to-safeguard-us-water-system"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.817Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) caused multiple businesses to halt operations due to the unavailability of the [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) and [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). These victims covered multiple sectors.(Citation: Jamie Tarabay and Katrina Manson December 2023)",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16ac0172-02d1-4fda-99c0-61f1cef7dc4b",
            "created": "2023-09-28T20:06:03.889Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.935Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16b74b29-e3b3-49ff-9ff4-cd7ade0f8ff4",
            "created": "2023-09-29T18:48:52.853Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.935Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16b92a53-7334-42b1-bc55-dcd4907fdd9f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.935Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16c7240e-0559-4c49-9003-1bfe97074252",
            "created": "2024-04-09T21:02:28.446Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.935Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16cca881-cf8b-4651-9ab1-cc8507cadd58",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--7f32731d-7800-483c-b077-c4a187a27ae5",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--16fe0039-b992-4432-a692-b30bb034e353",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--37b4971d-2eb8-4f87-899c-19acaf0394bb",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--171ed9c4-35f4-4674-b52d-d920c1a08912",
            "created": "2026-04-22T13:30:11.351Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.936Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--172e0537-7a9c-4610-9b07-32a841f0bd8d",
            "created": "2023-03-30T18:57:58.377Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec W32.Duqu",
                    "description": "Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.",
                    "url": "https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-06-12T16:00:28.144Z",
            "description": "[Duqu](https://attack.mitre.org/software/S0038) downloads additional modules for the collection of data from local systems. The modules are named: infostealer 1, infostealer 2 and reconnaissance.(Citation: Symantec W32.Duqu)",
            "relationship_type": "uses",
            "source_ref": "malware--68dca94f-c11d-421e-9287-7c501108e18c",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1736df4d-188e-4a44-a8b3-6c6cd71dc749",
            "created": "2023-09-29T17:05:30.498Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.936Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--17925772-5935-4f50-bf0e-abb5e0bad6b3",
            "created": "2026-04-22T20:42:55.066Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Aditya K Sood July 2019",
                    "description": "Aditya K Sood 2019, July Discovering and fingerprinting BACnet devices Retrieved. 2020/09/25 ",
                    "url": "https://www.helpnetsecurity.com/2019/07/10/bacnet-devices/"
                },
                {
                    "source_name": "Colin Gray",
                    "description": "Colin Gray D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25  How SDN Can Improve Cybersecurity in OT Networks Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6891_HowSDN_CG_20180720_Web2.pdf?v=20190312-231901"
                },
                {
                    "source_name": "D. Parsons and D. Wylie September 2019",
                    "description": "D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25 ",
                    "url": "https://www.csiac.org/journal-article/practical-industrial-control-system-ics-cybersecurity-it-and-ot-have-converged-discover-and-defend-your-assets/"
                },
                {
                    "source_name": "Josh Rinaldi April 2016",
                    "description": "Josh Rinaldi 2016, April Still a Thrill: OPC UA Device Discovery Retrieved. 2020/09/25 ",
                    "url": "https://www.rtautomation.com/rtas-blog/still-a-thrill-opc-ua-device-discovery/"
                },
                {
                    "source_name": "Langner November 2018",
                    "description": "Langner 2018, November Why Ethernet/IP changes the OT asset discovery game Retrieved. 2020/09/25 ",
                    "url": "https://www.langner.com/2018/11/why-ethernet-ip-changes-the-ot-asset-discovery-game/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.936Z",
            "description": "ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.(Citation: D. Parsons and D. Wylie September 2019)(Citation: Colin Gray) Examples of automation protocols with discovery capabilities include OPC UA Device Discovery (Citation: Josh Rinaldi April 2016), BACnet(Citation: Aditya K Sood July 2019), and Ethernet/IP.(Citation: Langner November 2018)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--17ae41a5-cb45-4935-bec1-ea0c8bfb2f34",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.937Z",
            "description": "This technique may not be effectively mitigated against, consider controls for assets and processes that lead to the use of this technique.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--17fd7ffd-63d9-4e1e-8b19-38095b2d65ab",
            "created": "2023-09-29T17:45:45.485Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.937Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--182010e6-59c2-42f5-91c7-510891a96483",
            "created": "2025-09-24T17:56:45.611Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.937Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1865830b-511d-4302-99f7-6143647a8e40",
            "created": "2023-10-02T20:23:52.339Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.938Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--186bd80c-9e22-4e3d-9515-dbe5c89892fe",
            "created": "2026-09-26T04:58:02.143Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T04:58:02.143Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) accessed internet accessible PLCs that were exposed through cellular gateways across multiple vendors including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--186ec539-6387-44a7-9354-3e524cedd495",
            "created": "2026-10-07T19:38:36.023Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:38:36.023Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18a562d1-0118-4675-9d66-8e9cc138dd43",
            "created": "2026-04-22T13:29:20.975Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.938Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18ab56e8-79ce-481d-9ab4-e558fbfb5ac5",
            "created": "2024-03-25T20:08:41.065Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                },
                {
                    "source_name": "CISA Unitronics November 2023",
                    "description": "DHS/CISA. (2023, November 28). Exploitation of Unitronics PLCs used in Water and Wastewater Systems. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems"
                },
                {
                    "source_name": "Frank Bajak and Marc Levy December 2023",
                    "description": "Frank Bajak and Marc Levy. (2023, December 2). Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say. Retrieved March 25, 2024.",
                    "url": "https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b"
                },
                {
                    "source_name": "Jamie Tarabay and Katrina Manson December 2023",
                    "description": "Jamie Tarabay and Katrina Manson. (2023, December 22). Iranian-Linked Hacks Expose Failure to Safeguard US Water System. Retrieved March 25, 2024.",
                    "url": "https://www.bloomberg.com/news/articles/2023-12-22/iranian-linked-hacks-expose-failure-to-safeguard-us-water-system"
                },
                {
                    "source_name": "WPXI Aliquippa Water November 2023",
                    "description": "WPXI. (2023, November 27). Officials investigating cyberattack on Municipal Water Authority of Aliquippa. Retrieved March 25, 2024.",
                    "url": "https://www.wpxi.com/news/local/officials-investigating-cyberattack-municipal-water-authority-aliquippa/K5A3BEW35RAXJPMNHNE35RZ7WA/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.827Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) defaced controllers’ [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002), which prevented multiple entities from being able to operate their devices normally.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: CISA Unitronics November 2023)(Citation: Jamie Tarabay and Katrina Manson December 2023)(Citation: Frank Bajak and Marc Levy December 2023) Additionally, the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) caused a communications failure in a remote pumping station.(Citation: WPXI Aliquippa Water November 2023)",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18af193c-160a-4cae-9078-4d69de5c2347",
            "created": "2023-09-29T18:56:21.340Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.938Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18af4cd0-5941-4754-86b8-5d2389fd5524",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--732d2487-3241-4866-8bb5-044bb4acdd3b",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18cb8770-09ab-48aa-8ead-b3d0030e47dc",
            "created": "2025-09-29T19:50:12.817Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.834Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18cdfacf-4eba-4049-b85f-d1cab5106c75",
            "created": "2023-09-29T18:02:01.822Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.938Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--18ef2d69-d11a-4d31-a803-da989c4073f7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.938Z",
            "description": "Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage  (Citation: National Institute of Standards and Technology April 2013). Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1992737e-0df0-43c6-8a43-85bf3802e470",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--eabde43f-1872-499d-9642-85a6959c4d28",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--19ab6776-42de-48af-975a-568d31a3bb66",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "N/A",
                    "description": "N/A Department of Homeland Security 2016, September Retrieved. 2020/09/25  Alarm Management for Process Control Retrieved. 2020/09/25 ",
                    "url": "https://www.exida.com/images/uploads/18492275-Alarm-Management-for-Process-Control.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.940Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016) (Citation: N/A)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--19dee45d-8c24-41ac-976f-aeb221c4f658",
            "created": "2026-10-08T21:53:52.361Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T02:43:26.360Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary denied operators the ability to control their systems by shutting down and disabling computerized water plant controls via malware over a wireless connection.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--19df16da-8247-45ef-be13-ba58b1fb9c1c",
            "created": "2023-09-28T20:11:23.956Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.940Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--19e9b914-3cb9-430c-ae02-f8e93fc2d826",
            "created": "2023-09-28T21:13:49.529Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.940Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a3ecee5-0237-4e01-8f02-90092c15a2f0",
            "created": "2023-10-02T20:18:45.122Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.437Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a40cec9-47c3-404e-b039-b7ae83ffaf68",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.940Z",
            "description": "Ensure all browsers and plugins are kept updated to help prevent the exploit phase of this technique. Use modern browsers with security features enabled.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a415b2d-3930-40be-b1f0-c6b47bb3e8ad",
            "created": "2026-10-07T19:39:21.553Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:39:21.554Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a6d5c5a-c1ac-41a6-8b6e-0d5df81b219f",
            "created": "2026-04-22T16:40:14.974Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a900ac4-c150-4b57-a899-990854b01d4b",
            "created": "2023-09-29T16:33:50.423Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a96ad0d-84df-4b6b-ba4c-8559de5ec356",
            "created": "2023-09-29T18:57:45.950Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a9ca148-a456-4b66-805f-a2bdfc7a947d",
            "created": "2023-09-28T20:09:21.736Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1aa02c37-973e-46bd-ab45-609463e514e9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "description": "If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1af5c5bb-0d97-4c0a-9174-4dee1ff8b185",
            "created": "2023-09-29T18:01:06.725Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.941Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1b36c370-6e82-4c2f-936d-a6fe8aafc73d",
            "created": "2024-09-11T22:51:15.202Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.942Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) execution relied upon accessing Internet-accessible devices for initial access and deployment.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1ba485c9-951e-4e07-8e69-1d0efc372f6b",
            "created": "2023-09-29T16:41:44.745Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.942Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1bb30143-97e5-4bbd-9c2b-1d8de70aa10c",
            "created": "2025-09-24T18:24:36.494Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.942Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1bb7b8cf-b584-427c-97e8-e4b60750d308",
            "created": "2026-04-20T20:54:20.114Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:20.114Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1bea0610-432c-4cd7-8e0e-8b7bbd09d738",
            "created": "2023-09-29T18:00:32.581Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.943Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1c3d966a-5995-48ed-919d-25b972010fe9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.943Z",
            "description": "Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.(Citation: IEC February 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1c7df4f1-cee5-42c6-a974-29552552666f",
            "created": "2023-09-28T19:47:08.952Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.943Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1c831708-28c2-47ae-a158-39f1f7b73406",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.943Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) contains an OPC DA module that enumerates all OPC servers using the `ICatInformation::EnumClassesOfCategories` method with `CATID_OPCDAServer20` category identifier and `IOPCServer::GetStatus` to identify the ones running.",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1cb7bae3-c3d7-43ba-8e51-3fd4d13b7680",
            "created": "2023-09-29T17:04:26.769Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.944Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1ccc0e03-1ea1-4916-ac6e-a1fb0366db19",
            "created": "2026-10-07T21:45:38.653Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:45:38.653Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1cf89a8b-c0f6-4ffb-ae39-36e2a9d3b081",
            "created": "2023-09-29T18:46:12.052Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.944Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1d0daee9-621c-47c8-b9f3-3b9a6dc5ea13",
            "created": "2025-09-29T19:46:29.316Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.944Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1d35c947-447f-4693-9ab0-32dff56e664e",
            "created": "2021-04-13T12:45:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.944Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) enumerates and parses the System Data Blocks (SDB) using the s7blk_findfirst and s7blk_findnext API calls in s7otbxdx.dll. Stuxnet must find an SDB with the DWORD at offset 50h equal to 0100CB2Ch. This specifies that the system uses the Profibus communications processor module CP 342-5. In addition, specific values are searched for and counted: 7050h and 9500h. 7050h is assigned to part number KFC750V3 which appears to be a frequency converter drive (also known as variable frequency drive) manufactured by Fararo Paya in Teheran, Iran. 9500h is assigned to Vacon NX frequency converter drives manufactured by Vacon based in Finland.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)\n\n[Stuxnet](https://attack.mitre.org/software/S0603) was specifically targeting CPUs 6ES7-315-2 (Series 300) with special system data block characteristics for sequence A or B and 6ES7-315-2 for sequence C. The PLC type can also be checked using the s7ag_read_szl API.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1d637465-fa54-4962-aa2d-cb0d04dfec0a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.457Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--33dd1c37-1702-4de2-9712-fcc640e4b681",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1d6fa472-a1fe-4657-a60d-c7f1c39b1653",
            "created": "2023-09-29T17:40:22.705Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.945Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1dad5efc-395f-4b92-8f4f-3e987a4d5e57",
            "created": "2023-09-27T13:22:26.752Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.732Z",
            "description": "(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1dc35f79-0ada-4342-bd13-10d10c1b0335",
            "created": "2021-04-13T12:28:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ben Hunter and Fred Gutierrez July 2020",
                    "description": "Ben Hunter and Fred Gutierrez 2020, July 01 EKANS Ransomware Targeting OT ICS Systems Retrieved. 2021/04/12 ",
                    "url": "https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.945Z",
            "description": "[EKANS](https://attack.mitre.org/software/S0605) performs a DNS lookup of an internal domain name associated with its target network to identify if it was deployed on the intended system. (Citation: Ben Hunter and Fred Gutierrez July 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
            "target_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1dd94603-3686-4dd5-b0be-2cdc43b0c1fb",
            "created": "2025-09-29T19:51:44.664Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.945Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1ddb73e6-b7a8-4f4d-bf8b-f9de3a5ef52a",
            "created": "2026-04-23T00:03:40.026Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.945Z",
            "description": "Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.(Citation: IEC February 2019)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1efbe3b3-4e8d-4f3f-b9f9-098c85840e33",
            "created": "2026-04-22T16:39:31.542Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.947Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1f393d04-36db-4bae-a2a4-53ff12a1240e",
            "created": "2023-09-28T21:12:25.345Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.947Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1f87378c-49fb-4da5-8ed3-3672633d3713",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.947Z",
            "description": "Regularly scan the internal network for available services to identify new and potentially vulnerable services.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1f886c01-1fff-452e-bb24-009c91be9b69",
            "created": "2026-04-20T20:54:18.047Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:18.047Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1f8abf6f-0dd0-4449-b555-733fe7296177",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.947Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System.(Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1fc147bd-d6ab-4beb-908b-0fbe8e125b76",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.948Z",
            "description": "Ensure users and user groups have appropriate permissions for their roles through Identity and Access Management (IAM) controls. Implement strict IAM controls to prevent access to systems except for the applications, users, and services that require access. Implement user accounts for each individual for enforcement and non-repudiation of actions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1fd4cf4e-a26c-4fe5-a7fd-f49b8aea8437",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tom Fakterman August 2019",
                    "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.948Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) initially executes when the user clicks on a JavaScript file included in the phishing emails .zip attachment. (Citation: Tom Fakterman August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1fd5badc-0e9f-462c-9738-550e7e8d8ae3",
            "created": "2023-09-28T19:54:37.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.948Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--20006064-4e2f-4106-a6b4-ee8b4c739c9b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--04bcf663-e6cd-42bf-8864-f4d1ad345263",
            "target_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--20031e48-2258-4901-ac21-bffd7191e931",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ae24274b-0e20-451e-a883-6eeb0e8e7d00",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2031d3aa-840e-4a6b-b0be-155f41c7d70e",
            "created": "2026-10-07T20:36:14.752Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:36:14.752Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2049ea95-0a5e-4b85-87c6-a8307d4cf738",
            "created": "2026-09-26T01:58:36.986Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:58:36.987Z",
            "description": "Inventory and audit Python interpreters, packages, virtual environments, execution paths, and ICS protocol libraries on assets where Python is authorized. Alert on new interpreters or packages outside approved engineering baselines.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2087b2b9-3b30-45be-abcd-4320bf0fa66b",
            "created": "2023-03-30T19:26:19.782Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Mandiant April 2022",
                    "description": "Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.",
                    "url": "https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"
                },
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.949Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) can iterate across a device’s IOAs to modify the ON/OFF value of a given IO state.(Citation: Industroyer2 Mandiant April 2022)(Citation: Industroyer2 Forescout July 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2089201c-c1c6-4d92-a737-a6499e26ee7f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.949Z",
            "description": "Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage  (Citation: National Institute of Standards and Technology April 2013). Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--208fe57b-cf2e-4188-8a6f-77597cd60351",
            "created": "2023-09-29T17:44:43.317Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.949Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--20913dc0-33cc-43f8-bd34-a2f9a4a5fbd3",
            "created": "2025-09-24T18:24:19.525Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.949Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2091a0be-48ce-4d5c-963b-8ba2842b57e3",
            "created": "2026-04-22T20:36:02.162Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.949Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--20a0d820-59ef-42fc-9f56-7a93d1ce7a84",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.867Z",
            "description": "If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--6a02e38a-9629-40c0-8c7d-e98e3470315c",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--20f66fab-7a08-4707-ac79-92dac5acd11d",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.950Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006)'s code is stored in OB9999. The original code on the target is untouched. The OB is automatically detected by the PLC and executed. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21041206-da58-45c7-adb0-db07caebdcb6",
            "created": "2021-04-13T12:36:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.950Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) uses the system function blocks TCON and TDISCON to initiate and destroy TCP connections to arbitrary systems. Buffers may be sent and received on these connections with TRCV und TSEND system function blocks. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21058f32-3d6e-4381-9288-5c2248e84cce",
            "created": "2023-09-29T18:44:27.240Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.950Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2138f4ee-5111-4469-92bb-1fc82a6822b4",
            "created": "2023-09-28T19:44:53.873Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.950Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21470001-67f2-47cf-af21-784e5024ac1d",
            "created": "2023-09-29T18:01:22.023Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.950Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2159458f-87fc-4479-81f4-a2521a378221",
            "created": "2023-09-28T21:22:09.790Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.489Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21aa6331-3419-4049-b180-8349b71e1f2a",
            "created": "2023-09-28T21:11:03.947Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.951Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21b6ec9c-8779-49db-bf19-90e81893a6e4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.951Z",
            "description": "Protect files stored locally with proper permissions  to limit opportunities for adversaries to impact data storage. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21c7b1bb-ba40-4843-b462-079b1b85c01b",
            "created": "2026-04-22T16:08:04.299Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.951Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21ccb883-2961-4b3a-9e1a-4439190aea49",
            "created": "2026-09-26T05:08:18.533Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:08:18.533Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) leveraged existing PLC management protocols through the manufacturer’s engineering tools. These include EtherNet/IP CIP, S7Comm, and UMAS.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--21e0e769-cc74-4e3b-8f88-072ebf8eaaf2",
            "created": "2025-09-29T19:24:56.529Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.951Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--220140ac-d927-4d86-9335-c04aa6ee3c61",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.951Z",
            "description": "Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Consider a jump server or host into the DMZ for greater access control. Leverage this DMZ or corporate resources for vendor access. (Citation: Keith Stouffer May 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--22401c3f-f64f-4ee6-94ee-24fe108b595a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--3e884c49-75ca-449e-83cb-3517ee88e0f1",
            "target_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--22448288-32d9-4d2c-be16-0784e119fff1",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.952Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--22548926-29b4-4882-9878-633375489c0e",
            "created": "2023-09-28T20:30:50.842Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.952Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2287eabb-5349-4d3e-938a-7d6023d7e02c",
            "created": "2025-09-29T22:04:12.484Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.952Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2289f005-7863-4af5-b681-cdfc03d3f111",
            "created": "2023-09-29T18:56:08.414Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.885Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--228b9a13-0545-4ecf-99ff-be02addaf7fe",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET",
                    "description": "ESET   ACAD/Medre.A: 10000s of AutoCAD Designs Leaked in Suspected Industrial Espionage Retrieved. 2021/04/13 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/200x/white-papers/ESET_ACAD_Medre_A_whitepaper.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.952Z",
            "description": "[ACAD/Medre.A](https://attack.mitre.org/software/S1000) can collect AutoCad files with drawings. These drawings may contain operational information. (Citation: ESET)\n",
            "relationship_type": "uses",
            "source_ref": "malware--a4a98eab-b691-45d9-8c48-869ef8fefd57",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--22ae18ec-d856-483c-a2ab-9db0739b0475",
            "created": "2026-04-20T20:54:19.543Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:19.543Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "target_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--232c7049-7609-46a9-8bbe-38672713f853",
            "created": "2023-09-28T21:15:32.371Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.953Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2346cbf5-b3c8-4110-a66c-6194251d4d49",
            "created": "2023-09-29T16:43:53.940Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.953Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--23564002-f836-4da6-a083-e086a606f0eb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--08c090e3-c56f-4a8b-80f6-307a1daf46ea",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2361ff8c-68a1-4899-a046-ba1b083272de",
            "created": "2026-04-20T20:54:23.490Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:23.490Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--23851bda-49de-4f35-979f-c4e6b5742389",
            "created": "2024-04-09T20:59:53.669Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.953Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--238f967a-0c29-4aa3-bbb5-3dc593473bbf",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Microsoft Security Response Center August 2017",
                    "description": "Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25 ",
                    "url": "https://msrc-blog.microsoft.com/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"
                },
                {
                    "source_name": "Wikipedia",
                    "description": "Wikipedia Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25  Control-flow integrity Retrieved. 2020/09/25 ",
                    "url": "https://en.wikipedia.org/wiki/Control-flow_integrity"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.953Z",
            "description": "Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: Microsoft Security Response Center August 2017) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia) Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--23f33619-c64e-4999-85c1-b5c88e570e46",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.954Z",
            "description": "Ensure embedded controls and network devices are protected through access management, as these devices often have unknown default accounts which could be used to gain unauthorized access.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--242b5a0d-e4e8-4ceb-a975-cf8efd64e981",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004",
                    "description": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY  IEC 61511 Retrieved. 2020/09/17 ",
                    "url": "https://www.icheme.org/media/9906/xviii-paper-23.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "description": "Protection devices should have minimal digital components to prevent exposure to related adversarial techniques. Examples include interlocks, rupture disks, release valves, etc. (Citation: A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8bc4a54e-810c-4600-8b6c-08fa8413a401",
            "target_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--243ad7b2-546c-4bf2-a3c0-1438b13e197d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "description": "Systems and devices should restrict access to any data with potential confidentiality concerns, including point and tag information.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2445124d-1fc9-49ad-8715-96053f39d717",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) uses a hardcoded password in the WinCC software's database server as one of the mechanisms used to propagate to nearby systems. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2452cc82-6ee0-4a98-a213-d5e3f3247e07",
            "created": "2023-09-28T20:25:47.357Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--245c8c36-28e5-4508-a585-7768cb33299a",
            "created": "2023-03-10T20:06:10.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.167Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary gained remote computer access to the system over radio.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--246ba662-bd89-4295-b603-582ebad285da",
            "created": "2026-04-23T00:27:24.380Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "description": "Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--24793eaf-f0d8-4baf-ba3d-900b87cf464d",
            "created": "2024-04-09T21:00:24.049Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--24d17e8f-0c0f-41d1-aa83-8b69b8d30be5",
            "created": "2023-09-29T17:07:55.738Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.955Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--24e1f6cf-44c3-4a3f-9839-5cd6398cc0fe",
            "created": "2023-09-28T20:10:06.838Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.956Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--250212f0-a149-4a14-af83-94f7fcedc021",
            "created": "2023-09-28T20:26:29.934Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.956Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--25095116-7b71-4a6d-8a98-b60adff61372",
            "created": "2026-04-22T22:57:07.320Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:54.942Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--527668a3-cc0c-48c2-856a-a45615817366",
            "target_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--25281488-be20-4d83-89d1-1da7ea836037",
            "created": "2023-09-29T17:40:47.898Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.956Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--25ddb2e0-b945-45d2-a8a9-6e6d5c4401d3",
            "created": "2023-03-30T18:57:21.754Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Kevin Savage and Branko Spasojevic",
                    "description": "Kevin Savage and Branko Spasojevic   W32.Flamer Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20190930124504/https:/www.symantec.com/security-center/writeup/2012-052811-0308-99"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.957Z",
            "description": "[Flame](https://attack.mitre.org/software/S0143) has built-in modules to gather information from compromised computers. (Citation: Kevin Savage and Branko Spasojevic)",
            "relationship_type": "uses",
            "source_ref": "malware--ff6840c9-4c87-4d07-bbb6-9f50aa33d498",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--25e7ca82-2784-433a-90a9-a3483615a655",
            "created": "2019-04-12T17:01:01.255Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye WannaCry 2017",
                    "description": "Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
                },
                {
                    "source_name": "SecureWorks WannaCry Analysis",
                    "description": "Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.",
                    "url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
                },
                {
                    "source_name": "FireEye APT38 Oct 2018",
                    "description": "FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
                },
                {
                    "source_name": "LogRhythm WannaCry",
                    "description": "Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved December 8, 2024.",
                    "url": "https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:46.507Z",
            "description": "(Citation: FireEye APT38 Oct 2018)(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)(Citation: SecureWorks WannaCry Analysis)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
            "target_ref": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--268b9429-b1c6-4bc3-84cf-8512e8ef57a7",
            "created": "2023-03-10T20:34:25.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.175Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary disabled alarms at four pumping stations, preventing notifications to the central computer.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--26bb65a5-a5c4-4a6a-9bdb-982abf425b49",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--47c6f72c-1f2f-4ea8-94d0-08202b7d5bdb",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--26fdd07e-d194-4f8e-a9af-d5b2f1d0222e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.958Z",
            "description": "Restrict root or administrator access on user accounts to limit the ability to capture promiscuous traffic on a network through common packet capture tools. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2711edd1-6042-4fec-9ba6-bc8653b6ca64",
            "created": "2026-10-07T21:53:04.761Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:53:04.761Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--274994e7-1fe9-463a-9979-46c72107bf9b",
            "created": "2023-03-30T18:56:47.685Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET",
                    "description": "ESET   ACAD/Medre.A: 10000s of AutoCAD Designs Leaked in Suspected Industrial Espionage Retrieved. 2021/04/13 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/200x/white-papers/ESET_ACAD_Medre_A_whitepaper.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.958Z",
            "description": "[ACAD/Medre.A](https://attack.mitre.org/software/S1000) collects information related to the AutoCAD application. The worm collects AutoCAD (*.dwg) files with drawings from infected systems. (Citation: ESET)",
            "relationship_type": "uses",
            "source_ref": "malware--a4a98eab-b691-45d9-8c48-869ef8fefd57",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--275fe31f-e6d5-4fab-8f63-a53063f84e68",
            "created": "2026-10-07T19:39:34.780Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:39:34.780Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--276aa6a6-e700-470a-8f72-02537ba7be9d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.958Z",
            "description": "Configure features related to account use like login attempt lockouts, specific login times, and password strength requirements as examples. Consider these features as they relate to assets which may impact safety and availability. (Citation: Keith Stouffer May 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--86b455f2-fb63-4043-93a8-32a3a7703a02",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--276f561b-5a3e-496e-a591-d4d465e80e29",
            "created": "2026-09-25T20:12:13.446Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:12:13.446Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries logged into the Mikronika RTUs via SSH, with root privileges, and executed Linux commands to delete all the files on the system resulting in device failure.(Citation: CERT Polska)\n",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--278cf882-835f-4e65-a8fc-bb8956dcbea0",
            "created": "2025-09-29T19:47:53.277Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.959Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--27cac33f-cb57-45ff-8312-5ebac2e22396",
            "created": "2026-04-22T17:50:24.743Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.959Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--27f87692-30c1-4693-b209-fdc78382badd",
            "created": "2023-09-28T20:17:07.288Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.959Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28134bdf-ddb3-4c34-b015-9af56898e646",
            "created": "2026-10-07T20:36:24.340Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:36:24.340Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--282731bc-968f-432a-937a-0343f3a8ba35",
            "created": "2026-04-22T22:32:58.268Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.959Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--283cbc1b-e998-4b44-81d1-c39f1f45b2bd",
            "created": "2026-09-26T05:10:45.992Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:10:45.992Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) manipulated critical shutdown and alarm logic.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--283d4fdb-f5db-4947-85d6-80b5de55d0c0",
            "created": "2026-09-25T18:42:50.630Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:42:50.630Z",
            "description": "Restrict privileged PowerShell use to authorized engineering and administrative accounts and controlled access paths. Separate routine operator activity from privileged maintenance and engineering functions. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2867f491-919b-463f-b689-bb3ceb7ae99f",
            "created": "2022-09-28T20:31:07.486Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos-Pipedream",
                    "description": "DRAGOS. (2022, April 13). Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                },
                {
                    "source_name": "Brubaker-Incontroller",
                    "description": "Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can use the CODESYS protocol to remotely connect to Schneider PLCs and perform maintenance functions on the device.(Citation: Wylie-22)\n\n[INCONTROLLER](https://attack.mitre.org/software/S1045) can use Telnet to upload payloads and execute commands on Omron PLCs.\t(Citation: Brubaker-Incontroller)(Citation: Dragos-Pipedream) The malware can also use HTTP-based CGI scripts (e.g., cpu.fcgi, ecat.fcgi) to gain administrative access to the device.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--287b247f-8ec3-4d8d-a521-050ac8c791ad",
            "created": "2023-09-29T18:05:32.443Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--287b2ad4-e455-45f1-ae03-c0605ef5b1cd",
            "created": "2026-10-07T20:36:37.339Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:36:37.339Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28afd84d-a53e-4b2f-9bee-133f7da6982a",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) copies the input area of an I/O image into data blocks with a one second interval between copies, forming a 21 second recording of the input area. The input area contains information being passed to the PLC from a peripheral. For example, the current state of a valve or the temperature of a device. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28b06a92-2933-49f5-887e-c09cf1bb861f",
            "created": "2026-04-22T22:52:28.627Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "description": "Implement network allowlists to minimize network access to only authorized hosts.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28bb99c4-ac44-406c-bd5d-cabb273363fb",
            "created": "2026-04-23T00:28:35.816Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28d4feb4-7a87-4376-8401-d579f830472b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--4ea060f9-f6fc-4122-9544-70afd567ea10",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--28e89bca-04a2-462f-9d84-d5dc4d55d98e",
            "created": "2023-09-28T21:26:47.115Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.960Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--29397fec-dc16-4407-81a2-9e53cc082570",
            "created": "2026-04-22T13:29:48.617Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.961Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2971151c-0e8a-4567-84dc-01cf5dd35005",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.961Z",
            "description": "Digital signatures may be used to ensure application DLLs are authentic prior to execution.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--29c2757d-c5f6-4c8d-bbdd-3629cb14dd81",
            "created": "2023-09-29T18:46:39.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.962Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--29ebbcee-3c41-42e1-8a3e-1c6678ca5ece",
            "created": "2025-09-29T19:46:51.576Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.962Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2a451896-81aa-4eed-a444-4d04661adeeb",
            "created": "2023-09-29T16:43:42.911Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.962Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2aaa6840-47fc-455c-9b19-1d27c3afccbe",
            "created": "2023-09-28T19:38:46.361Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.896Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ad5f781-1f7c-4bb9-984a-9299a307132f",
            "created": "2026-04-22T16:40:40.952Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.963Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2b2871ae-e8e6-429e-b9e3-91852d1c5cb8",
            "created": "2026-09-26T03:36:10.758Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:36:10.758Z",
            "description": "Restrict MQTT, AMQP, DDS, and other publish/subscribe traffic to approved brokers, peers, ports, topics, namespaces, and security zones. Block unauthorized external broker access while preserving documented IIoT/OT messaging paths.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2b62e4c0-9267-47bd-8f4d-0394b13fb566",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.964Z",
            "description": "Once an adversary has access to a remote GUI they can abuse system features, such as required HMI functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2b7d57d7-3802-4b59-99c6-1e1597fe78d1",
            "created": "2023-09-29T18:46:54.684Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.964Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2bfb3a93-422c-4a36-a9c2-c5a9e79477d8",
            "created": "2026-09-26T03:00:05.537Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:00:05.537Z",
            "description": "Require ICS assets to use approved DNS resolvers and restrict direct DNS, DoT, and DoH to unauthorized external resolvers or services. Apply allowlists for documented vendor/cloud dependencies and monitor exceptions rather than assuming all encrypted DNS is malicious.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2c1510bc-99d2-43d6-a58c-585d2dab485e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ffeac6e1-798f-41b1-8baf-2650d2ebe031",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2c479e7e-422c-4329-8fb9-4484e2fdbf9c",
            "created": "2026-10-08T21:51:14.254Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-08T23:59:22.450Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary remotely accessed internet-facing devices (e.g., MicroLogix 1100 and 1400 controllers, etc.) and changed passwords resulting in loss of monitoring and control for the affected utilities.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2c6c4752-536e-4b96-86d7-7efe88350082",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.965Z",
            "description": "Provide an alternative method for sending critical command messages to outstations, this could include using radio/cell communication to send messages to a field technician that physically performs the control function.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2c79920a-f2d1-4114-a1df-924835da645c",
            "created": "2023-09-28T19:53:00.672Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.965Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2caa292a-4d54-4efb-bf79-79ce5c7a962c",
            "created": "2026-10-07T20:37:02.606Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:37:02.606Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2cd79563-0f5a-44a1-9be4-6dc330855d64",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.965Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ce3d5d3-6575-4b4c-a67c-64fb31974540",
            "created": "2023-09-28T21:16:44.471Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.965Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d0bed1d-342b-44a0-aec8-e6d7c6596fa2",
            "created": "2023-09-29T16:33:12.887Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.966Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d17672c-ceaf-4fbb-8f3e-a00996b240c8",
            "created": "2026-04-22T20:26:56.868Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                },
                {
                    "source_name": "Dragos ELECTRUM JAN 2026",
                    "description": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf. (2026, January). ELECTRUM: CYBER ATTACK ON POLAND’S ELECTRIC SYSTEM 2025. Retrieved April 22, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.533Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries wiped devices and also damaged Mikronika RTUs, Hitachi Relion Protection and Control Relays (IEDs), and HMI workstations resulting in a loss of communications and view between the facility and the distribution system operators (DSO).(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d312430-66d1-4549-a5f9-47abc2730e43",
            "created": "2023-09-29T16:46:12.472Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.966Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d3548a6-37ca-4105-b4e8-7c233d29d17f",
            "created": "2026-10-07T21:46:20.554Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:46:20.554Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d621264-4a6d-4bc7-abaf-89a89c2ef813",
            "created": "2026-04-22T16:03:38.326Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.966Z",
            "description": "Devices should verify that firmware has been properly signed by the vendor before allowing installation.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2daeeaaa-5b4b-4bb7-a94d-78a5749027ca",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.966Z",
            "description": "Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49b306c1-a046-42c5-a4d2-30f264ada110",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2dc39956-05d1-4dd5-86db-cb70568d73fe",
            "created": "2023-09-29T17:39:15.857Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.966Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2dd1d205-55e4-4226-9221-5839f2268e57",
            "created": "2026-04-22T20:24:29.733Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.546Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries corrupted the firmware in the Hitachi RTUs resulting in a fault that triggered a reboot loop.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2de38f5e-b97c-498a-a4c9-f13e5d2d233c",
            "created": "2023-03-22T15:53:59.953Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.967Z",
            "description": "Devices and programs that receive command messages from remote systems (e.g., control servers) should verify those commands before taking any actions on them.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2de9fc26-3c9b-4ecf-b613-795586f5414b",
            "created": "2026-10-07T22:07:21.684Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T22:07:21.684Z",
            "description": "Use supported exploit-protection controls on Windows-based ICS overlap assets to reduce execution paths commonly used to launch or inject PowerShell-driven payloads. Validate compatibility with HMI, historian, engineering, and vendor applications before enforcement.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2e32e0fd-24cf-4a41-b56d-98ada9f1db8a",
            "created": "2023-09-28T19:40:51.425Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.967Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2e5f338d-92c4-4647-8fef-7c901ff774f5",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.967Z",
            "description": "Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from databases. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2e9a021d-6dbe-4ee5-a98b-041bb13d2836",
            "created": "2026-04-22T16:38:10.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.967Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ecc567f-3aaa-4bd8-935f-4808d177a552",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.968Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ecf9476-b546-44ff-8547-4ca56cf7eeb8",
            "created": "2023-09-28T20:02:05.365Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.968Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f0d1a71-7cb6-4979-b072-a859d117d47f",
            "created": "2023-09-27T14:47:29.337Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.763Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) used valid accounts to laterally move through VPN connections and dual-homed systems. Sandworm Team used the credentials of valid accounts to interact with client applications and access employee workstations hosting HMI applications.  (Citation: Ukraine15 - EISAC - 201603)(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f15fa70-7e2d-4ef3-9654-0404e71ac343",
            "created": "2022-09-28T21:18:55.279Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.969Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can send custom Modbus commands to write register values on Schneider PLCs.(Citation: CISA-AA22-103A) \n\n[INCONTROLLER](https://attack.mitre.org/software/S1045) can send write tag values on OPC UA servers.(Citation: CISA-AA22-103A) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f457bef-1721-4e0f-b236-24e4652a31b4",
            "created": "2023-09-29T16:29:53.181Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.970Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f6b635b-1441-4ef0-9289-1ed6b9098d4a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS  National Urban Security Technology Laboratory April 2019",
                    "description": "DHS  National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17 ",
                    "url": "https://www.dhs.gov/sites/default/files/saver-msr-rf-detection_cod-508_10july2019.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.971Z",
            "description": "Reduce the range of RF communications to their intended operating range when possible. Propagation reduction methods may include (i) reducing transmission power on wireless signals, (ii) adjusting antenna gain to prevent extensions beyond organizational boundaries, and (iii) employing RF shielding techniques to block excessive signal propagation.  (Citation: DHS  National Urban Security Technology Laboratory April 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e",
            "target_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f7c49a0-89fe-4d18-915c-c321868d47bd",
            "created": "2024-04-09T21:02:56.157Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.971Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f8c9deb-aefe-4fa3-b00c-ec15fd154233",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.972Z",
            "description": "Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid messages.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2f9c25af-d2e2-4793-85bf-6e2696384a50",
            "created": "2023-09-28T20:30:21.865Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.974Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2fbb7867-79c5-4d45-9876-98c4041dd72e",
            "created": "2021-10-14T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.974Z",
            "description": "Consider implementing full disk encryption, especially if engineering workstations are transient assets that are more likely to be lost, stolen, or tampered with. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2fd13fc0-e3f0-4099-ab20-d19ba6bcd4e0",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.975Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) examines fields recorded by the DP_RECV monitor to determine if the target system is in a particular state of operation. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2fd35996-196f-4a58-9dab-07f52c74f4d3",
            "created": "2026-04-20T20:54:17.065Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:17.065Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2fd8a76f-4663-4251-a16d-e1f105a854f9",
            "created": "2023-09-28T19:43:28.167Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.975Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ff351dc-5b86-4a5b-b0f0-7ac1af8f891f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--336b9423-5543-4354-bd00-13c614ccdc96",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2ff82993-5010-4450-89e7-341f449f3263",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.975Z",
            "description": "Consider periodic reviews of accounts and privileges for critical and sensitive repositories.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3003564d-fb12-4509-946b-818e4e5b8431",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.976Z",
            "description": "Devices should authenticate all messages between master and outstation assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--30227ffe-9019-4fed-9ee2-e4cfba77e3ec",
            "created": "2026-04-22T20:42:19.762Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.976Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--305866af-1f36-49e0-a57d-d5faaf29011c",
            "created": "2023-09-28T20:34:52.740Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.977Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3066ddc9-b4e8-41b6-a28f-9de5030cb714",
            "created": "2026-04-22T15:56:30.348Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:56.058Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--73773bb8-c63b-4d48-9b48-33440f12a514",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--309e4558-e591-4d03-9bb9-07d30acf011f",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "McAfee Labs October 2019",
                    "description": "McAfee Labs 2019, October 02 McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service  What The Code Tells Us Retrieved. 2021/04/12 ",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.978Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) searches for all processes listed in the prc field within its configuration file and then terminates each process. (Citation: McAfee Labs October 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31402349-2c5a-4811-addd-a345801836ac",
            "created": "2026-09-25T18:42:15.991Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:42:15.991Z",
            "description": "Use application control/allowlisting to restrict PowerShell hosts, script paths, interpreters, and child-process behavior to approved engineering and operational workflows. Prefer explicit allowlists over broad blocking on production OT systems.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--314a1b91-167a-4ad5-a36b-8bbdbd286540",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c94af5cb-61c3-4180-81e7-30c1669f4252",
            "target_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31563b1f-37d8-4399-bd0c-9c93445f87d9",
            "created": "2026-10-07T19:37:53.692Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:37:53.692Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--316110bc-9b4c-41e4-96eb-d8051a4fda6c",
            "created": "2023-09-28T20:16:05.975Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.981Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--316279ab-7d07-4159-8021-d2f38e6d5b01",
            "created": "2026-10-07T19:37:30.093Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:37:30.093Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--317ce6a3-7767-4be3-a201-004368f1b2ec",
            "created": "2025-09-29T19:53:08.323Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.981Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31897c41-1d47-4a34-b531-21c3f74651a8",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.981Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) utilizes the PLC communication and management API to load executable Program Organization Units. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31b8d0d3-2e81-4367-80c0-1173988e77d7",
            "created": "2026-04-23T00:04:58.358Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.982Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31bf1721-78a2-4b6c-b325-5c44dc02ea33",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Eduard Kovacs March 2018",
                    "description": "Eduard Kovacs 2018, March 1 Five Threat Groups Target Industrial Systems: Dragos Retrieved. 2020/01/03 ",
                    "url": "https://www.securityweek.com/five-threat-groups-target-industrial-systems-dragos"
                },
                {
                    "source_name": "Novetta Threat Research Group February 2016",
                    "description": "Novetta Threat Research Group 2016, February 24 Operation Blockbuster: Unraveling the Long Thread of the Sony Attack Retrieved. 2016/02/25 ",
                    "url": "https://web.archive.org/web/20220707091904/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:46.548Z",
            "description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) has been observed targeting organizations using spearphishing documents with embedded malicious payloads. (Citation: Novetta Threat Research Group February 2016) Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company. (Citation: Eduard Kovacs March 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31e67caf-6b34-4651-96fc-5b97609c843a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ad675d25-2829-48e5-8475-28f1ed5d813a",
            "target_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--321dfef3-01bf-40ee-901e-6354b945c31a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--b6a6d95c-e3b5-438d-a095-3fb0859c8f45",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--32438a90-406c-40f7-a5ac-a1ca92cd51d5",
            "created": "2023-09-28T20:26:15.542Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.984Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--327916f7-fe5d-4858-adeb-f72f74c60c25",
            "created": "2021-10-08T15:25:32.143Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.225Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) sends an SQL statement that creates a table and inserts a binary value into the table. The binary value is a hex string representation of the main Stuxnet DLL as an executable file (formed using resource 210) and an updated configuration data block. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--327f65bc-8a33-4dbb-88d4-714a9e42442b",
            "created": "2023-09-28T21:21:07.833Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.985Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--32b2bb93-7ddc-4f96-8bfd-2534309a9d75",
            "created": "2023-09-29T17:45:55.581Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.985Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--32bcf2cf-3311-4ef1-9bf4-4bfe14832b3b",
            "created": "2023-09-28T20:10:23.215Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.985Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--32d15d1a-04ba-4035-907a-e2871425e8d1",
            "created": "2023-09-28T20:28:40.722Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.986Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--330af428-95f6-4530-99ca-05bd00756b9f",
            "created": "2026-09-25T17:29:40.723Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T17:29:40.723Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--260bc795-4a3d-4ca6-8fd1-5e687112d20c",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--33215dfa-53d0-4bd7-a15d-cec9315c7c4d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.986Z",
            "description": "Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Steps should be taken to periodically inventory internet accessible devices to determine if it differs from the expected.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--337f366d-3d76-470c-8ee2-0e2252648282",
            "created": "2024-03-25T20:19:43.390Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.986Z",
            "description": "Disallow the execution of applications/programs which are not required for normal system functions, including any specific command-line arguments which may allow the execution of proxy commands or application binaries.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--33974565-1d55-445f-9f6f-983707000cf4",
            "created": "2026-04-22T22:50:10.723Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.987Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--33b1b49f-012d-4af3-835a-32d8c75b9e1b",
            "created": "2026-04-22T20:38:11.633Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.987Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3412e6dd-6adb-4c91-a5d8-c4f68dd362d5",
            "created": "2025-09-24T18:21:00.372Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.989Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--34535779-9957-4766-a7fc-e8d4dbfb5eee",
            "created": "2025-09-24T17:57:06.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.989Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--345e698d-8302-4e84-9c5b-c3b78972c0e1",
            "created": "2026-04-22T13:54:38.311Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.989Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3471632d-253d-469e-9e8c-3b291b4ae88a",
            "created": "2023-09-28T21:14:15.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.989Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3478c49c-594b-4224-b7f9-2b0b09c67288",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Bastille April 2017",
                    "description": "Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 ",
                    "url": "https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.989Z",
            "description": "Utilize strong cryptographic techniques and protocols to prevent eavesdropping on network communications.  (Citation: Bastille April 2017)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3481b497-85b5-4733-8fc4-ae58de12aa29",
            "created": "2026-10-07T21:16:11.167Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:16:11.167Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3484426b-33b6-4f9b-9b62-3dd114794848",
            "created": "2026-04-20T20:58:46.793Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:46.793Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--34ac1b1b-1103-4fc9-a62e-f1dd1451b28b",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "description": "Provide the ability to verify the integrity of control logic or programs loaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically strong and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used. (Citation: IEC February 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--34cacc74-a461-4ed9-a683-952cbeea6e1d",
            "created": "2026-04-23T00:36:39.544Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--34d4101b-b4c9-4ea3-a84d-81e84e7f5033",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "description": "Segment networks and systems appropriately to reduce access to critical system and services communications.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--34dcc9e8-a43a-475b-81b6-b15240545075",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                },
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.(Citation: Karen Scarfone; Paul Hoffman September 2009)(Citation: Keith Stouffer May 2015)(Citation: Department of Homeland Security September 2016)(Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--350814da-5c36-42f9-8e58-8f9534e6ce0a",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework \"TRITON\" and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009)'s injector, inject.bin, masquerades as a standard compiled PowerPC program for the Tricon. (Citation: DHS CISA February 2019)\n\n[Triton](https://attack.mitre.org/software/S1009) was configured to masquerade as trilog.exe, which is the Triconex software for analyzing SIS logs.(Citation: FireEye TRITON)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3522ad60-960f-4b77-ba34-64b0d32995ab",
            "created": "2026-09-25T20:32:41.531Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:32:41.531Z",
            "description": "Harden applications that can host or launch VB/VBA/VBScript content and reduce exposed script-host execution paths where operationally feasible.  ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3526acc8-8834-4aaa-87a5-51e587360cf5",
            "created": "2023-09-29T18:45:47.394Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.990Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--352ed52c-88ba-4731-a917-4c33da0f29d4",
            "created": "2023-09-27T14:44:00.588Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Andy Greenberg June 2017",
                    "description": "Andy Greenberg. (2017, June 28). How an Entire Nation Became Russia's Test Lab for Cyberwar. Retrieved September 27, 2023.",
                    "url": "https://www.wired.com/story/russian-hackers-attack-ukraine/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.778Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) used an IT helpdesk software to move the mouse on ICS control devices to maliciously release electricity breakers. (Citation: Andy Greenberg June 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--355988ca-6eba-4f49-a08f-932f0fda998f",
            "created": "2026-10-07T21:56:20.813Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:56:20.813Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--35bacdf8-60e5-4590-a71c-43c53c94509a",
            "created": "2026-09-25T20:28:19.065Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:28:19.065Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--35cf6922-d48f-42ea-b7f5-f0258892bd52",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.993Z",
            "description": "Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--35d3a730-4de6-4406-a025-ad29340985c2",
            "created": "2025-09-24T18:21:48.981Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.993Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3618a010-b94b-4974-b1be-7630d5c853c1",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Robert Falcone, Bryan Lee May 2016",
                    "description": "Robert Falcone, Bryan Lee 2016, May 26 The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor Retrieved. 2019/11/19 ",
                    "url": "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:35.322Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) used spearphishing emails with malicious Microsoft Excel spreadsheet attachments. (Citation: Robert Falcone, Bryan Lee May 2016)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3623e266-6de4-4165-b0fb-e9abf0813e5d",
            "created": "2026-04-22T22:31:00.015Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.993Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3666c249-26c8-4aad-8dc7-5d07253b1c5c",
            "created": "2025-09-29T19:07:15.758Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.994Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--366a4cd1-aa95-4985-9d80-b45a2551e298",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.994Z",
            "description": "Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3680ab7a-254b-426c-b417-460712c2f357",
            "created": "2026-04-22T20:43:20.666Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.994Z",
            "description": "Ensure proper network segmentation is followed to protect critical servers and devices.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--368558ce-e8a6-4375-b54f-47c2ab31e38d",
            "created": "2023-09-28T20:29:27.153Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.994Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37048032-b41d-47d8-9c73-7b706bef24d1",
            "created": "2023-09-28T20:27:58.625Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--371fe079-430d-46dc-ad31-a53838fc6c24",
            "created": "2025-09-29T19:06:13.410Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--372c2e72-d56a-4501-a3bc-31b6b0c8d0be",
            "created": "2023-09-28T21:13:36.185Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.237Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3731962f-64e7-4750-ac8b-40b97eef8725",
            "created": "2023-09-29T16:41:15.943Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--373627f1-5e68-45ab-b1ac-c063d9585a3e",
            "created": "2025-09-24T17:56:56.872Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--374837a0-6109-4c95-bee6-893b25ac71cf",
            "created": "2023-09-28T21:13:12.715Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37754ab4-03de-475b-8eb2-4ac3fad63852",
            "created": "2025-09-29T19:06:24.302Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.995Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37aeaf27-6bbe-4949-ba77-37649e38f8b2",
            "created": "2023-09-29T16:31:46.749Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.996Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37b2e059-853e-423f-8504-a11b55f92160",
            "created": "2026-09-26T03:57:34.150Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty-IOCONTROL",
                    "description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
                    "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:57:34.150Z",
            "description": "IOCONTROL has conducted port scans on a network.(Citation: Claroty-IOCONTROL)",
            "relationship_type": "uses",
            "source_ref": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37e1b5d8-c800-4eee-9348-e183cc62d385",
            "created": "2023-09-28T21:09:33.225Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.996Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--37f0a727-5b6a-4acc-83fc-e2c13f5acc39",
            "created": "2026-04-22T22:50:35.824Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.996Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--380ef144-1443-4df1-b7de-a6ed3d66d573",
            "created": "2026-04-22T13:28:38.829Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.996Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--38165ec5-a989-4e77-bf30-31c892da23c1",
            "created": "2026-09-25T20:41:55.229Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:41:55.229Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--57970b21-17a5-4536-a089-5277ebc575f9",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3838eb1c-488a-4e73-bc3d-e25cacd6926d",
            "created": "2026-04-20T20:58:37.797Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:37.797Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--383e242a-72d4-4b40-8905-888595c34919",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Kelly Jackson Higgins",
                    "description": "Kelly Jackson Higgins   How a Manufacturing Firm Recovered from a Devastating Ransomware Attack Retrieved. 2019/11/03 ",
                    "url": "https://www.darkreading.com/attacks-breaches/how-a-manufacturing-firm-recovered-from-a-devastating-ransomware-attack/d/d-id/1334760"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.997Z",
            "description": "An enterprise resource planning (ERP) manufacturing server was lost to the [Ryuk](https://attack.mitre.org/software/S0446) attack. The manufacturing process had to rely on paper and existing orders to keep the shop floor open. (Citation: Kelly Jackson Higgins)",
            "relationship_type": "uses",
            "source_ref": "malware--a020a61c-423f-4195-8c46-ba1d21abba37",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3843dcca-62a2-4224-9241-05f981fa880a",
            "created": "2023-09-28T19:46:23.921Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.997Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--387a9ace-17bd-484b-8d54-d3bbc1304c90",
            "created": "2026-04-22T20:08:53.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.571Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used Advanced Port Scanner and Advanced IP Scanner to conduct remote system discovery activities.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--388df1cd-3e92-4eee-ac0f-6d8b824cd42f",
            "created": "2026-09-26T05:09:20.561Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:09:20.561Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used the manufacturers’ commercial PLC programming software to push new configurations to victim hardware. These include Rockwell Automation’s [Studio Logix 5000 Designer](https://attack.mitre.org/software/S9054), Schneider Electric’s [EcoStruxure Control Expert](https://attack.mitre.org/software/S9056), and Siemens’ [Totally Integrated Automation (TIA) Portal](https://attack.mitre.org/software/S9055). In these changes, adversaries deleted program logic, removed Add-On Instructions (AOIs) and manipulated alarm logic and HMI screens.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--38bda770-c470-4358-a9ad-a5b39bec026b",
            "created": "2023-09-29T16:28:28.550Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.997Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--393983b0-aeb0-4cc0-ae77-8180fe9f8f87",
            "created": "2025-09-24T18:04:47.207Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.998Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--39452123-574f-4f3a-95ec-a90170a3d7eb",
            "created": "2023-10-02T20:20:44.850Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.998Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--399126a9-815d-4c3b-9d5e-f57d698ac742",
            "created": "2023-09-28T19:40:36.023Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.999Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--39dcfc44-5f18-475f-b431-22032a14cbe5",
            "created": "2026-04-22T22:52:48.727Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.999Z",
            "description": "Segment operational networks to isolate critical systems and devices that do not require broad network access.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--39e5a489-f557-4130-a285-e0a82f40685c",
            "created": "2023-09-28T19:46:38.112Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.999Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--39f785a8-4175-4d3c-ba64-e20ad4bc2584",
            "created": "2023-09-28T19:40:21.763Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:05.999Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a20ed21-5e69-4a16-a0e3-bace3eba9974",
            "created": "2023-09-29T18:56:47.109Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.000Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a6cd53d-0d4e-4cf8-8edf-f9ebde4faac4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a76a181-8706-4bc4-9c66-7e809fec44ca",
            "created": "2023-09-28T19:44:37.687Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a7d1db3-9383-4171-8938-382e9b0375c6",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "description": "[BlackEnergy](https://attack.mitre.org/software/S0089) uses HTTP POST request to contact external command and control servers. (Citation: Booz Allen Hamilton)\n",
            "relationship_type": "uses",
            "source_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a9a07b5-0db5-40c6-b3e4-d1a006c85726",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--67c2be08-d31a-4385-a637-9d1a907c7a26",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3a9fc435-30b7-4684-a874-026c129aaa79",
            "created": "2025-09-24T17:54:22.945Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3aa2691d-d88d-4467-ae3e-242b3bac22ea",
            "created": "2023-09-28T21:15:18.036Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3ab912a4-70aa-45f8-b2ef-57113dde2cfa",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA March 2010",
                    "description": "CISA 2010, March 11 https://us-cert.cisa.gov/ncas/tips/ST05-003 Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/ncas/tips/ST05-003"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "description": "Do not inherently rely on the authenticity provided by the network/link layer (e.g., 802.11, LTE, 802.15.4), as link layer equipment may have long lifespans and protocol vulnerabilities may not be easily patched. Provide defense-in-depth by implementing authenticity within the associated application-layer protocol, or through a network-layer VPN. (Citation: CISA March 2010)  Furthermore, ensure communication schemes provide strong replay protection, employing techniques such as timestamps or cryptographic nonces.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3abaee7a-5d15-4364-9c74-775865a404b4",
            "created": "2026-04-22T20:24:57.226Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.001Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3ad966be-8cb2-42e6-b696-ef9e3b512e35",
            "created": "2023-09-28T19:43:15.817Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.002Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3afa12ce-4380-4e66-aa1d-4da20ac9023b",
            "created": "2026-04-22T22:49:32.456Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.002Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3b6567a9-6213-4db4-a069-1a86b1098b63",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Microsoft Security Response Center August 2017",
                    "description": "Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25 ",
                    "url": "https://msrc-blog.microsoft.com/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"
                },
                {
                    "source_name": "Wikipedia",
                    "description": "Wikipedia Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25  Control-flow integrity Retrieved. 2020/09/25 ",
                    "url": "https://en.wikipedia.org/wiki/Control-flow_integrity"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.003Z",
            "description": "Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: Microsoft Security Response Center August 2017) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia) Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3b7f39cb-0101-49b0-ab02-a5adb1672688",
            "created": "2023-09-28T19:53:33.603Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.003Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3b9a4916-78b9-44b3-b0fc-6f167a918d7d",
            "created": "2026-04-23T00:40:03.895Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.003Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3bb10579-917d-4f59-ac6d-0bd731bffbdb",
            "created": "2026-10-07T20:28:53.866Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:28:53.866Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3bc61c8f-3d04-40bd-8239-a15913056bb2",
            "created": "2023-10-02T20:22:15.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.004Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3bd0868c-7124-4a84-9541-d6f95f746dd9",
            "created": "2026-09-25T19:13:21.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T17:27:10.928Z",
            "description": "The name of the [Industroyer](https://attack.mitre.org/software/S0604) payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoors that executes shell commands. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3c2d1b8a-d092-4a71-a0d4-dc5abff338bc",
            "created": "2025-09-24T18:23:15.201Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.004Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3c31f7d1-61c2-4fed-b4b6-601d8958e2f6",
            "created": "2026-10-07T21:56:54.021Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:56:54.021Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3c790a63-5216-4418-9233-53c5921e0363",
            "created": "2026-10-07T20:30:46.344Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:30:46.344Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3ce078ca-dad7-477a-8178-f0daf7ee823b",
            "created": "2025-09-24T18:18:30.255Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.008Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3cf99739-b045-4a83-985d-e9984076b81d",
            "created": "2026-04-23T00:04:07.892Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.008Z",
            "description": "ll field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3d005ed8-77d3-4fed-9dd5-7e39ba8cb50a",
            "created": "2021-04-13T12:45:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.008Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) calls system function blocks which are part of the operating system running on the PLC. Theyre used to execute system tasks, such as reading the system clock (SFC1) and generating data blocks on the fly. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3d3c5d24-be5c-42e8-98ca-3b04382df39a",
            "created": "2023-09-28T21:26:11.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.008Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3d676c1b-2650-4599-8a57-790c55f9977d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.009Z",
            "description": "Minimize the exposure of API calls that allow the execution of code.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3d991288-1770-4211-83dc-441ef9944e0f",
            "created": "2026-04-22T18:56:11.575Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.009Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3dd15958-b159-4d01-b3c2-37bdf9b417b5",
            "created": "2023-09-29T17:05:08.346Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.009Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3dd35c9a-146d-4370-80ac-69fed35d81a1",
            "created": "2023-09-29T16:44:16.391Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.009Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3e0c8afc-4c4d-40cc-bb61-f76b3fc1b013",
            "created": "2025-09-29T19:58:46.808Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.009Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3e1f42f9-2edf-4c32-ac1e-da726b923570",
            "created": "2026-04-23T00:37:08.211Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.010Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3e249f0a-5755-4e0f-96ce-f3ce6376fed5",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.010Z",
            "description": "Provide an alternative method for sending critical report messages to operators, this could include using radio/cell communication to obtain messages from field technicians that can locally obtain telemetry and status data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3e9093f7-6212-4b34-b22e-4ecabc27c654",
            "created": "2026-04-22T22:34:50.733Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.010Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3ea96b43-20d6-4a92-ae44-874a2dc17136",
            "created": "2026-09-25T20:29:01.731Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:29:01.731Z",
            "description": "During the [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilizes a Visual Basic script `lun.vbs` to execute `n.bat` which then executed the MicroSCADA `scilc.exe` command.(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "relationship_type": "uses",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f07067f-0cbc-489c-8722-a33399ebd4f9",
            "created": "2023-09-29T17:39:42.457Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.011Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f106b71-2d71-4910-a909-24191ab6349f",
            "created": "2026-10-07T20:19:14.515Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:19:14.515Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f261739-b6ec-4a86-94a3-146929f9facf",
            "created": "2024-11-20T23:28:20.295Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.528Z",
            "description": "In [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041), the adversary caused the victim controllers to report incorrect measurements by modifying parameters.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f335e8f-68da-4b06-9d96-f371ddaf23e6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.011Z",
            "description": "Ensure wireless networks require the authentication of all devices, and that all wireless devices also authenticate network infrastructure devices (i.e., mutual authentication). For defense-in-depth purposes, utilize VPNs or ensure that application-layer protocols also authenticate the system or device. Use protocols that provide strong authentication (e.g., IEEE 802.1X), and enforce basic protections, such as MAC filtering, when stronger cryptographic techniques are not available.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f76d408-be8a-478e-8a5a-aab1d1f96572",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Julian Rrushi, Hassan Farhangi, Clay Howey, Kelly Carmichael, Joey Dabell December 2015",
                    "description": "Julian Rrushi, Hassan Farhangi, Clay Howey, Kelly Carmichael, Joey Dabell 2015, December 08 A Quantitative Evaluation of the Target Selection of Havex ICS Malware Plugin Retrieved. 2019/04/01 ",
                    "url": "https://pdfs.semanticscholar.org/18df/43ef1690b0fae15a36f770001160aefbc6c5.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.011Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) ICS malware plugin relies on Windows networking (WNet) to discover all the servers, including OPC servers, that are reachable by the compromised machine over the network. (Citation: Julian Rrushi, Hassan Farhangi, Clay Howey, Kelly Carmichael, Joey Dabell December 2015)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f9093f6-fb01-45e0-924f-a71a536336b2",
            "created": "2023-09-29T18:06:35.470Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.011Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f92c11b-f6e2-4c07-9913-9fa7469ba4fe",
            "created": "2023-09-28T21:17:18.201Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.011Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f9d6d25-6824-48b9-a7d3-6d4729250a33",
            "created": "2026-10-07T20:19:27.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:19:27.440Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3f9f3845-33a9-488a-afd7-8db1bb53fe88",
            "created": "2023-09-28T19:39:25.832Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.012Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3fe69c6d-6722-44ad-bab7-e34981d68daa",
            "created": "2023-09-28T20:27:43.727Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.012Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4011b9e8-317f-40b9-bd3c-3fb1e99c6542",
            "created": "2023-09-29T18:57:32.665Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.012Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--40477010-e2db-4e4d-8896-6e401a89ac03",
            "created": "2023-09-29T16:28:39.397Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.013Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--40479f3e-d4d2-45f8-893f-f8a4fcf1613c",
            "created": "2022-09-28T21:16:28.195Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.912Z",
            "description": "The [INCONTROLLER](https://attack.mitre.org/software/S1045) PLCProxy module can add an IP route to the CODESYS gateway running on Schneider PLCs to allow it to route messages through the PLC to other devices on that network. This allows the malware to bypass firewall rules that prevent it from directly communicating with devices on the same network as the PLC.(Citation: Wylie-22)",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4059da6f-b52b-4265-8bf9-3ad6154dbde4",
            "created": "2023-09-29T18:05:42.611Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.013Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4071dca7-2405-4856-8130-44cc1aadded2",
            "created": "2026-04-22T20:39:47.699Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.013Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--408b2389-3280-46c6-8c94-2579b47b2340",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--13412b71-b94e-4aef-912a-44853f8bff05",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--40fdaedd-04b4-42ad-8bea-a0513de65f73",
            "created": "2026-04-22T20:02:08.818Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.595Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used `netstat` to enumerate network connections on the Mikronika HMI computers.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--413c1c41-6ef9-413b-a75a-e67f1668b3db",
            "created": "2023-09-29T17:04:46.290Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.510Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--413d5a01-4e80-4d8a-a9ad-9d90792b852a",
            "created": "2026-04-22T16:10:04.096Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.014Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--415b3d09-f30e-4f25-8cae-bbe7fef80275",
            "created": "2025-09-24T18:19:25.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.014Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--41856149-91d5-4815-b50f-8eb371ac5ba6",
            "created": "2023-03-10T20:09:49.009Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.183Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--419a1f4b-b36e-44ec-8a91-d4138c5fb353",
            "created": "2026-10-07T17:52:25.669Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:52:25.669Z",
            "description": "Restrict untrusted web content and active scripting on ICS workstations, jump hosts, and other overlap assets, especially where browser access is not required for operations.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--41a109dd-11d9-4840-a38b-088fc790f45a",
            "created": "2024-03-25T20:17:27.552Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--41abc220-4ec6-41cc-bb36-37c43341fc41",
            "created": "2026-04-22T16:07:47.332Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--41adaf0b-b7ae-4bdb-9a5b-567fd0911d7a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--41dbf626-b968-4b51-9f7d-aaea14d39b4d",
            "created": "2023-09-28T19:58:43.542Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4211c12a-57cf-4ebb-910a-6af7aa09cf34",
            "created": "2021-04-12T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "description": "All communication sessions to remote services should be authenticated to prevent unauthorized access.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--423271c0-04dc-42d0-8e27-fb0b6067e096",
            "created": "2023-09-27T14:59:43.382Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.794Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), power breakers were opened which caused the operating companies to be unable to deliver power, and left thousands of businesses and households without power for around 6 hours. (Citation: Ukraine15 - EISAC - 201603)(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4256a0c2-437d-4a4c-88ac-d08d3041b8c1",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--42577e40-8a29-461b-aeb6-232f4b04d76a",
            "created": "2025-09-24T17:55:49.673Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.015Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--42ab7d24-8286-4a7a-8cd7-02e54a80e13f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.016Z",
            "description": "Ensure permissions restrict project file access to only engineer and technician user groups and accounts.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4302566f-0eee-43a2-b40d-658e7cc0a57b",
            "created": "2023-09-28T19:49:25.824Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.016Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--432b2dc0-52ff-488f-a5e9-c1e510fc7a0b",
            "created": "2023-09-28T19:58:54.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.017Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43344cd7-5004-4dac-8b62-8899105fa265",
            "created": "2023-09-29T18:47:20.334Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.017Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--433539bf-cb17-4de1-9c0f-e579b041514f",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Inc. June 2017",
                    "description": "Dragos Inc. 2017, June 13 Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations Retrieved. 2017/09/18 ",
                    "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.924Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) attempts to connect with a hardcoded internal proxy on TCP 3128 [default Squid proxy]. If established, the backdoor attempts to reach an external C2 server via the internal proxy. (Citation: Dragos Inc. June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4369da69-bb09-4cc8-8600-081a450f50e0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.017Z",
            "description": "Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4387dbb0-8602-4485-ab55-2ed63d8b1622",
            "created": "2025-09-29T19:05:01.891Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.017Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43ab749c-d449-4fca-a14b-0f3a991fcdcc",
            "created": "2025-09-24T18:15:06.489Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.017Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43aecac8-9920-4cbf-bdd0-6a204cb64942",
            "created": "2026-04-22T13:26:48.062Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.018Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43d9821c-13ba-4009-b58b-a073918b780f",
            "created": "2025-09-29T19:57:56.590Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.018Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43e7ed35-4038-4bc3-82bb-d5ff337b368a",
            "created": "2025-09-24T18:23:02.137Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.018Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--446c95ea-5178-4ae9-8f92-cb20dd50f7de",
            "created": "2021-04-13T12:36:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.019Z",
            "description": "Minimize the exposure of API calls that allow the execution of code.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--44c857cf-7a4e-405a-87ca-7f6d79000589",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.019Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--44dd2e01-9aca-44c4-bfb8-05d16c928793",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--a995ba7c-c2c2-4d74-a3da-74e5a192099b",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--44e0627e-d100-4e11-adab-4ff093e6031e",
            "created": "2023-09-29T17:37:41.336Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.019Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4560f607-106b-4546-8f58-bd45c2a5c5f8",
            "created": "2026-04-22T22:36:45.186Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.020Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--456ff399-4925-45d4-aa84-d930eae5348e",
            "created": "2023-09-28T20:26:47.786Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.020Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--45aae58e-1d09-49de-b4c2-837c6f1d5d8f",
            "created": "2023-10-02T20:22:02.539Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.248Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--45d14170-7f7b-4e08-b53f-42fa4a3a04d9",
            "created": "2023-09-28T20:15:32.382Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.021Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--45ee1822-71e4-4d92-976d-306561b70555",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.021Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--461e81a2-c7ad-499e-908d-05ef2f7bd9cd",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.021Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4653847b-c089-4435-9159-6f76353833f7",
            "created": "2023-09-25T20:43:22.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.021Z",
            "description": "All field controllers should restrict the modification of controller tasks to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--46690df4-ddac-4ed4-8987-8706ae68a0cf",
            "created": "2023-09-29T16:42:20.944Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.021Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--46798892-d849-43fe-8147-b40cc9da291e",
            "created": "2023-09-28T19:42:29.359Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.261Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--46bc86e4-e20b-4778-80d2-8891039e6fb4",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Hydro",
                    "description": "Hydro Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16  Retrieved. 2019/10/16 ",
                    "url": "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/"
                },
                {
                    "source_name": "Kevin Beaumont",
                    "description": "Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ",
                    "url": "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.022Z",
            "description": "While Norsk Hydro attempted to recover from a [LockerGoga](https://attack.mitre.org/software/S0372) infection, most of its 160 manufacturing locations switched to manual (non-IT driven) operations. Manual operations can result in a loss of productivity. (Citation: Kevin Beaumont)(Citation: Hydro)",
            "relationship_type": "uses",
            "source_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--46e4cdd2-e8f0-46aa-9264-868815a05af9",
            "created": "2024-03-25T20:17:59.424Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.022Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4768c731-3be9-44b8-a217-dfbececa57d9",
            "created": "2023-09-29T18:06:22.868Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.023Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--476fdcf2-0b39-4ddc-9744-ef54d3b9efb8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--6f921aa8-deb3-4286-8101-26a7cbe80c0e",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--47b1bc70-9fe4-4a6f-a137-f51db24566da",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--bbb288c7-9e40-46bd-b0a1-db4cfef4e1ee",
            "target_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--47f15a06-8675-4698-833d-bd141ed9e755",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Microsoft Security Response Center August 2017",
                    "description": "Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25 ",
                    "url": "https://msrc-blog.microsoft.com/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"
                },
                {
                    "source_name": "Wikipedia",
                    "description": "Wikipedia Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25  Control-flow integrity Retrieved. 2020/09/25 ",
                    "url": "https://en.wikipedia.org/wiki/Control-flow_integrity"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.023Z",
            "description": "Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: Microsoft Security Response Center August 2017) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia) Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--484b0873-59ef-41a3-b33d-b3fb41a2c957",
            "created": "2024-04-09T20:50:34.946Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.024Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--485499a0-221b-4f32-bcf5-99697775e0cd",
            "created": "2026-10-07T21:14:27.387Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:14:27.387Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--48874e6b-1b97-4c3b-af85-7bfaceff4a4a",
            "created": "2026-10-07T20:19:59.748Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:19:59.748Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--48e142d5-ebfe-4950-8704-409c6b92f693",
            "created": "2026-04-20T20:54:22.411Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:22.411Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--490c0435-b918-4843-bee1-0584f8092ce4",
            "created": "2026-04-23T16:34:50.702Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--491455dc-f7c8-4e12-811b-b8c5c041b4c3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--49242ea8-4813-49f7-8bd4-9668216cceeb",
            "created": "2023-09-29T16:45:53.300Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4966e63c-ca05-466d-91f9-41d799a54471",
            "created": "2021-04-12T18:59:17.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "description": "Provide privileges corresponding to the restriction of a GUI session to control system operations (examples include HMI read-only vs. read-write modes). Ensure local users, such as operators and engineers, are giving prioritization over remote sessions and have the authority to regain control over a remote session if needed. Prevent remote access sessions (e.g., RDP, VNC) from taking over local sessions, especially those used for ICS control, especially HMIs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--497e0dbf-b36e-4c2e-9368-67553c8ba5b1",
            "created": "2025-09-24T18:25:02.119Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4981a944-b3ad-4d78-9881-a17d458e3422",
            "created": "2023-09-28T20:01:30.138Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.025Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--49966e16-04a2-4fd7-86cd-aa934040a9d8",
            "created": "2023-03-31T17:44:19.711Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.272Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) used a VBS script to facilitate lateral tool transfer. The VBS script was used to copy ICS-specific payloads with the following command: `cscript C:\\Backinfo\\ufn.vbs C:\\Backinfo\\101.dll C:\\Delta\\101.dll`(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--49aebf0c-e231-4cbb-84a2-97c9a6d11654",
            "created": "2026-04-22T17:59:31.637Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.026Z",
            "description": "Ensure proper network segmentation is followed to protect critical systems and devices.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--49d38b21-5ce5-48d9-a356-639fc6c7a53d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.026Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4a641966-3cc8-4dd6-aa61-1a96cfff4a05",
            "created": "2023-09-28T19:41:47.648Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.027Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4a7340fc-0eec-4459-a491-952d736b79ef",
            "created": "2023-09-28T19:50:42.505Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.523Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4ad65338-18dd-4ccf-96d9-a15c0af8e2e2",
            "created": "2026-09-26T05:30:11.136Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:30:11.136Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) disrupted water operations that have included loss of water pressure and flooding.(Citation: Tenable Minnesota Water Utilities)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4b353f8e-15ff-4fab-9f09-270ffb744a0f",
            "created": "2026-04-22T16:09:40.257Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.028Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4b44a657-11cc-45bc-b096-f32e58a70036",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.028Z",
            "description": "Restrict unauthorized devices from accessing serial comm ports.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4b6a964f-af5c-4ec2-a309-c1ae6b929596",
            "created": "2023-09-28T21:24:51.818Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.028Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4b853b7c-bc55-4599-b88d-d08d651526c0",
            "created": "2023-09-29T18:49:25.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.028Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4b98b72c-a093-4917-a21b-a0b4f388e98e",
            "created": "2023-03-31T17:45:09.659Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:25.681Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) used MS-SQL access to a pivot machine, allowing code execution throughout the ICS network.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4bcbf856-1a3f-4dcf-8e00-5e925025ffc4",
            "created": "2026-04-22T20:24:18.093Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.029Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4be1cc93-c5f8-4501-a10b-489463101169",
            "created": "2026-10-07T19:46:29.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:46:29.393Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c10bd09-f51b-4190-811d-8ee3c6fb7696",
            "created": "2026-10-07T17:52:00.452Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:52:00.452Z",
            "description": "Use application control to restrict wscript.exe, cscript.exe, mshta.exe, Node.js, and other JavaScript runtimes to approved paths, parent processes, scripts, and users.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c1df272-9c2a-4647-8d05-3c0de1613e12",
            "created": "2023-09-28T19:59:23.856Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.029Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c4fe037-c9ae-4f38-b717-901d3ce09528",
            "created": "2026-09-25T16:50:21.360Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-08T01:22:21.388Z",
            "description": "Execution prevention may block malicious software from accessing protected resources through the command-line interface.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c53b294-973f-4cc2-a781-6c86b8f1c962",
            "created": "2023-09-28T21:23:14.975Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.029Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c5f0aeb-d4ae-4f37-9fec-ba4d844a0c21",
            "created": "2026-04-22T21:48:25.479Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:57.262Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c779ee07-ee85-42fe-a2c1-14ce25766cdf",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4c6b7176-650b-448d-9d5b-28eb36bcafae",
            "created": "2026-04-22T20:06:22.552Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.029Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) uses a Python script that is capable of detecting Triconex controllers on the network by sending a specific UDP broadcast packet over port 1502. (Citation: DHS CISA February 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4cb8291c-f9eb-4c84-bb15-695685fd7064",
            "created": "2026-04-22T21:36:57.379Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.030Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4cc2bf97-b439-40a9-8e18-cc9daca1bab6",
            "created": "2026-04-22T19:00:02.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.030Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4cec834f-831f-46e6-9cd2-a6fdfa45d06b",
            "created": "2023-09-29T17:44:19.135Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.030Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4d163eab-7118-49c3-a4e9-d4f26d09b314",
            "created": "2025-09-24T18:13:02.344Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.030Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4d407dda-944a-4974-b1c2-0a04d2c9ee4c",
            "created": "2023-09-27T13:17:12.592Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Andy Greenberg June 2017",
                    "description": "Andy Greenberg. (2017, June 28). How an Entire Nation Became Russia's Test Lab for Cyberwar. Retrieved September 27, 2023.",
                    "url": "https://www.wired.com/story/russian-hackers-attack-ukraine/"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.810Z",
            "description": "(Citation: Andy Greenberg June 2017) (Citation: US District Court Indictment GRU Unit 74455 October 2020)",
            "relationship_type": "attributed-to",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4d501413-0a23-4f44-97b8-38ddbc38c04a",
            "created": "2026-09-25T20:34:17.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:34:17.394Z",
            "description": "Disable Windows Script Host, Office macro capability, or other VB execution surfaces only on ICS assets where they are not required by validated vendor or engineering workflows. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4d76274d-75bc-4cd0-be6a-3d5d99f73cb7",
            "created": "2023-09-28T20:27:04.841Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.031Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4dd93fd2-6e6d-4c50-a091-6d6ea6903f1e",
            "created": "2022-09-28T21:21:58.641Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.031Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can use the HTTP CGI scripts on Omron PLCs to modify parameters on EtherCat connected servo drives.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4e1e6e4b-c38b-477e-8026-f12a58558484",
            "created": "2026-04-20T20:58:39.169Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:39.169Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4e7ec200-9a1b-46d4-9383-738903fec554",
            "created": "2026-04-23T00:39:29.524Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.032Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4ef202e5-b1cb-4cc4-892d-df6bf683c596",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--5604323b-6e7a-4801-91ae-4bf591f2e3ac",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4f086dee-d4ed-41fb-a4f7-e6b7875a98eb",
            "created": "2026-10-07T20:38:02.187Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:38:02.187Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4f3a843b-18e7-46e8-8285-9102a2fe62e5",
            "created": "2023-09-29T18:02:38.399Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.033Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4f7cc4b9-fe3a-4883-97cc-4d2a44c55be9",
            "created": "2023-09-28T20:09:53.108Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.033Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4f83cc15-274d-44c6-859f-e598e362e76e",
            "created": "2023-09-27T14:55:55.381Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.837Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) opened live breakers via remote commands to the HMI, causing blackouts. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4fde32fb-56b6-458b-92ac-55f81bc91783",
            "created": "2026-04-20T20:54:26.012Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:26.012Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4fde6641-ad83-4b23-b51c-97fe7bdc558c",
            "created": "2025-09-24T18:14:52.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.034Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--502a0b7e-048a-468a-b888-e91fde47c6eb",
            "created": "2021-04-12T18:59:17.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "North America Transmission Forum December 2019",
                    "description": "North America Transmission Forum 2019, December NATF Transient Cyber Asset Guidance Retrieved. 2020/09/25 ",
                    "url": "https://www.natf.net/docs/natf/documents/resources/security/natf-transient-cyber-asset-guidance.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "description": "Segment and control software movement between business and OT environments by way of one directional DMZs. Web access should be restricted from the OT environment. Engineering workstations, including transient cyber assets (TCAs) should have minimal connectivity to external networks, including Internet and email, further limit the extent to which these devices are dual-homed to multiple networks. (Citation: North America Transmission Forum December 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50324c5f-50e9-4d81-a8ba-a076827259a0",
            "created": "2026-04-22T20:25:20.492Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--503c5256-b611-437e-a4ef-2ee1fd20ab29",
            "created": "2023-09-29T18:03:06.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5041e17d-6349-4589-8c61-7b43964b5f9b",
            "created": "2021-10-14T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Emerson Exchange",
                    "description": "Emerson Exchange   Increase Security with TPM, Secure Boot, and Trusted Boot Retrieved. 2020/09/25 ",
                    "url": "https://emersonexchange365.com/products/control-safety-systems/f/plc-pac-systems-industrial-computing-forum/8383/increase-security-with-tpm-secure-boot-and-trusted-boot"
                },
                {
                    "source_name": "National Security Agency February 2016",
                    "description": "National Security Agency 2016, February Position Zero: Integrity Checking Windows-Based ICS/SCADA Systems Retrieved. 2020/09/25 ",
                    "url": "https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/industrial-control-systems/position-zero-integrity-checking-windows-based-ics-scada-systems.cfm"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "description": "Integrity checking of transient assets can include performing the validation of the booted operating system and programs using TPM-based technologies, such as Secure Boot and Trusted Boot. (Citation: Emerson Exchange) It can also include verifying filesystem changes, such as programs and configuration files stored on the system, executing processes, libraries, accounts, and open ports.   (Citation: National Security Agency February 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--504f74ff-ce0c-4e2d-840a-79c17ba2cbce",
            "created": "2026-04-22T20:40:31.895Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5068c7c3-5922-447a-bf49-8301e797e992",
            "created": "2023-09-27T14:51:18.262Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.849Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) overwrote the serial-to-ethernet gateways with custom firmware to make systems either disabled, shutdown, and/or unrecoverable. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--508cf980-e2da-4a34-a069-23201ad336e5",
            "created": "2026-10-07T21:54:06.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:54:06.902Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50a10bc7-950b-4a12-aeaf-52a7b013efc2",
            "created": "2026-10-08T21:53:21.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:01:31.082Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed passwords on internet-facing MicroLogix controllers, causing the affected utilities to lose monitoring of their equipment (e.g., water tower, lift station, etc.).(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50a2b289-7bce-405d-8515-c2b5424cce5c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.035Z",
            "description": "Information which is sensitive to the operation and architecture of the process environment may be encrypted to ensure confidentiality and restrict access to only those who need to know. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50b3247a-ea71-455e-b299-f00666c05146",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.036Z",
            "description": "In states 3 and 4 [Stuxnet](https://attack.mitre.org/software/S0603) sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. For example one of the frames contains records that change the maximum frequency (the speed at which the motor will operate). The frequency converter drives consist of parameters, which can be remotely configured via Profibus. One can write new values to these parameters changing the behavior of the device. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50c20664-75dc-451e-b026-67b1d309e4b5",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.036Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually. (Citation: Anton Cherepanov, ESET June 2017) Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50c2224e-7592-4400-afbb-6434e025bfd8",
            "created": "2022-09-29T14:28:08.703Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.036Z",
            "description": "Ensure embedded controls and network devices are protected through access management, as these devices often have unknown hardcoded accounts which could be used to gain unauthorized access.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5131c799-517c-4bad-ba97-46ad7de956e7",
            "created": "2023-09-28T21:17:06.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.036Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--513e6965-7ce0-47de-b2a0-8f0ba4978ce4",
            "created": "2026-04-22T18:54:42.908Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.036Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5152ea91-af3f-4317-81ca-b3cf910b471a",
            "created": "2026-04-22T20:27:50.811Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.535Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries enabled TCP port 445 on Mikronika HMI devices creating a new firewall rule named “Microsoft Update”.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--51957f0f-79e2-4716-beec-0fec67e4482f",
            "created": "2025-09-24T18:11:54.747Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--51eb15a3-48af-470f-94c0-10f25b366d72",
            "created": "2022-09-28T20:30:22.148Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos-Pipedream",
                    "description": "DRAGOS. (2022, April 13). Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can establish a remote HTTP connection to change the operating mode of Omron PLCs.(Citation: Dragos-Pipedream)(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--51f9963c-c041-4bec-b482-5fda2fb5bca4",
            "created": "2019-06-24T17:20:24.258Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Catalin Cimpanu April 2016",
                    "description": "Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 ",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "description": "A [Conficker](https://attack.mitre.org/software/S0608) infection at a nuclear power plant forced the facility to shutdown and go through security procedures involved with such events, with its staff scanning computer systems and going through all the regular checks and motions before putting the plant back into production. (Citation: Catalin Cimpanu April 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5201c576-70a5-4b32-8dfd-dd8ac86f096c",
            "created": "2023-09-29T16:40:18.760Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--520aad6a-2483-45bc-a172-2417137f6ca0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "description": "Utilize out-of-band communication to validate the integrity of data from the primary channel.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5212f36b-216f-4e32-8b64-3b4c94dfada5",
            "created": "2021-04-10T14:13:17.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "description": "Enforce strong password requirements to prevent password brute force methods for lateral movement.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--523777f8-4780-4716-807c-08a67450b916",
            "created": "2023-09-29T18:45:13.052Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.037Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--524ffb0f-40ae-4c97-a098-d14001fffa31",
            "created": "2023-09-29T16:44:54.473Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--525d0a51-bbf9-4cda-aec9-562bb05bd3a0",
            "created": "2024-04-09T20:58:49.397Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--527676d2-9dd0-40c6-8fc5-10209a82c986",
            "created": "2023-09-28T20:04:44.041Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52855d5d-e835-470f-a675-751c2779c861",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "description": "Utilize out-of-band communication to validate the integrity of data from the primary channel.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--529610e5-831f-48df-a22f-fa088b9f9e9e",
            "created": "2025-09-29T19:10:58.772Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52a592dd-61c0-4884-a680-0d6f9112077e",
            "created": "2026-04-22T21:35:28.147Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52bfd00c-2e5b-4e43-bba6-f3b46e241d7b",
            "created": "2023-09-28T21:23:26.598Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52c7176b-431d-44a6-8c03-7c15a8cf6ce1",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "description": "Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage  (Citation: National Institute of Standards and Technology April 2013). Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52c85466-d3d2-46f5-9597-5fae78de9c51",
            "created": "2026-10-07T21:54:51.635Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:54:51.635Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--52e828db-58d0-443e-8d94-54d265d9606e",
            "created": "2023-09-29T17:42:01.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.038Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5338abbc-11f7-44e4-b97e-5439c1c1b45b",
            "created": "2023-10-02T20:20:32.163Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.039Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--533bd747-2567-4c53-a10b-938734f8aeab",
            "created": "2024-03-25T17:59:02.526Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "FireEye TEMP.Veles 2018",
                    "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
                    "url": "https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
                },
                {
                    "source_name": "FireEye TRITON 2018",
                    "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.158Z",
            "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) leveraged [Triton](https://attack.mitre.org/software/S1009) to interact and disrupt Triconex safety instrumented systems throughout this campaign.(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TRITON 2018)(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5343d50a-a36a-4470-9390-98ecd19b800b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--f9b7143b-ce86-4cfb-a03a-f39c01904fb1",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--535c5160-17e0-44eb-9f4b-1a8e216b56a2",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.039Z",
            "description": "The execution on the PLC can be stopped by violating the cycle time limit. The [PLC-Blaster](https://attack.mitre.org/software/S1006) implements an endless loop triggering an error condition within the PLC with the impact of a DoS. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--53754728-a86b-4db2-b4de-197bd491167f",
            "created": "2026-04-22T16:30:09.937Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:58.468Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ff6456fc-576d-4da5-b561-b58f70961b15",
            "target_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--538e5653-137a-4ce2-8b08-5ba69caa794a",
            "created": "2024-03-25T17:58:07.886Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                },
                {
                    "source_name": "FireEye TEMP.Veles 2018",
                    "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
                    "url": "https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:42.170Z",
            "description": "(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "attributed-to",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--53a54e4a-2b38-4b0c-8f60-252a68767443",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.039Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) modifies the Import Address Tables DLLs to hook specific APIs that are used to open project files. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--53af6987-21bb-46fd-bf85-e3eeaa74de1a",
            "created": "2023-03-30T14:08:23.251Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA June 2013",
                    "description": "CISA 2013, June Risks of Default Passwords on the Internet Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA13-175A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.039Z",
            "description": "Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.(Citation: CISA June 2013)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--53d7a78d-1431-49e8-944c-62c875e58a20",
            "created": "2023-09-29T17:08:37.793Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.040Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5424e327-396f-4b07-94a3-408ffc915686",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos",
                    "description": "Dragos   Allanite Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/resource/allanite/"
                },
                {
                    "source_name": "ICS-CERT October 2017",
                    "description": "ICS-CERT 2017, October 21 Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors Retrieved. 2017/10/23 ",
                    "url": "https://www.us-cert.gov/ncas/alerts/TA17-293A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:27.996Z",
            "description": "[ALLANITE](https://attack.mitre.org/groups/G1000) has been identified to collect and distribute screenshots of ICS systems such as HMIs. (Citation: Dragos) (Citation: ICS-CERT October 2017)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
            "target_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5425d1cd-8840-4640-90a3-72f3bd7151bd",
            "created": "2023-09-29T17:44:32.341Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.040Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--544e996c-0bdc-42b2-91af-14c27d4213b9",
            "created": "2023-09-28T21:09:23.185Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.040Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--544f0447-0f37-4b1c-b424-3fbcdee15e63",
            "created": "2026-04-23T00:40:43.328Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.040Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--54a7bc3f-c05f-4fb3-a980-ffc8750a0a56",
            "created": "2023-09-28T20:10:44.014Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.041Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--54a977df-ca85-43b2-b2bc-96fdcd23aa9b",
            "created": "2023-03-30T19:24:38.022Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Mandiant April 2022",
                    "description": "Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.",
                    "url": "https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.041Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) has the capability to terminate specified processes (i.e., PServiceControl.exe and PService_PDD.exe) and rename each process to prevent restart. These are defined through a hardcoded configuration.(Citation: Industroyer2 Mandiant April 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5526e92e-070b-402e-b149-a06bff5a4549",
            "created": "2026-09-26T05:13:25.808Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:13:25.808Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) manipulated process logic, HMI, and SCADA displays, which may disrupt operators view of the system.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5542d884-ac75-4e1f-9d60-29add89c8567",
            "created": "2025-09-29T19:02:48.640Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.042Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--55adf560-78f2-4804-a135-ec49bb70c6a4",
            "created": "2026-04-22T16:38:28.001Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.042Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56636da0-ea2b-4c51-87d2-f7fcff26ea1a",
            "created": "2026-04-22T18:57:23.003Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.043Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56672ea4-cbf0-4a3e-8aed-edcc7d33133b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.043Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56896f6b-27fe-4396-bfea-d3c1a7580b18",
            "created": "2023-09-29T18:05:18.147Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.043Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56a561d2-5230-4456-99b5-989dbeac715c",
            "created": "2025-09-24T18:20:10.625Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.043Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56dcc2d7-5243-4a5d-a556-8723642e98a4",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.044Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) would reset the controller to the previous state over TriStation and if this failed it would write a dummy program to memory in what was likely an attempt at anti-forensics. (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56f22365-3711-468a-8f57-ee4193bf1ee8",
            "created": "2025-09-29T21:57:55.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.044Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--575f0e0b-d68d-432b-abb3-cbd3e641fc88",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.044Z",
            "description": "Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid reporting messages.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--577b53a0-44ff-4cc4-b571-455d61e596c0",
            "created": "2023-09-28T20:27:17.431Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--578117b2-0f4b-4d75-a2dc-3ee45976e616",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--57abea59-09c3-496f-a6b9-21c6a0cb9b7a",
            "created": "2026-04-22T20:17:22.389Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.633Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used the `nircmd` utility to capture screenshots of systems.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--57e8711a-9aae-4a22-94d4-f4c8a3a8f141",
            "created": "2023-03-31T18:12:35.414Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Industroyer",
                    "description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:25.729Z",
            "description": "Within the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Industroyer](https://attack.mitre.org/software/S0604) was used to target and disrupt the Ukrainian power grid substation components.(Citation: Dragos Crashoverride 2018)(Citation: ESET Industroyer)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--57ff803c-0380-4176-bb42-f7bb30e79fec",
            "created": "2025-09-29T19:58:27.480Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5804ae3d-0daf-47a5-b026-d42878f55803",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "description": "This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5812613d-e4ef-4201-a717-c7f239daeaf3",
            "created": "2026-04-22T22:48:32.057Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58269882-7e8d-4d24-b7a3-dbef6196cb61",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--582aca6c-d421-4c84-89fc-f52e87cc306a",
            "created": "2026-04-22T18:55:28.835Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.045Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58978012-8185-4a15-9bbc-6bdb33c91039",
            "created": "2026-04-20T20:54:16.595Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:16.595Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58a0fd57-ea5f-46b0-84ac-c5b963fb7e94",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.046Z",
            "description": "Use multi-factor authentication wherever possible.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ddf3e568-f065-49e2-9106-42029a28ddbd",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58cb4cb5-4b0f-4ce0-b3f9-5deb9de31c52",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.046Z",
            "description": "Utilize out-of-band communication to validate the integrity of data from the primary channel.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58edd7e0-7b54-4ac5-8e84-81e2dfb03a71",
            "created": "2026-04-22T22:21:11.962Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "LockerGoga Revisited",
                    "description": "Joe Slowik. (2020, March 17). Spyware Stealer Locker Wiper: LockerGoga Revisited. Retrieved April 22, 2026.",
                    "url": "https://www.dragos.com/blog/industry-news/spyware-stealer-locker-wiper-lockergoga-revisited/"
                },
                {
                    "source_name": "Kevin Beaumont",
                    "description": "Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ",
                    "url": "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"
                },
                {
                    "source_name": "Detecting LockerGoga",
                    "description": "Oleg Kolesnikov and Harshvardhan Parashar. (2019, April 30). Detecting LockerGoga Targeted IT/OT Cyber Sabotage/Ransomware Attacks. Retrieved April 22, 2026.",
                    "url": "https://www.securonix.com/wp-content/uploads/2021/07/Securonix-Threat-Research-Report-Detecting-LockerGoga.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.046Z",
            "description": "[LockerGoga](https://attack.mitre.org/software/S0372) had blocked network communications by disabling all the network interfaces on the system via netsh.exe.(Citation: LockerGoga Revisited)(Citation: Kevin Beaumont)(Citation: Detecting LockerGoga)",
            "relationship_type": "uses",
            "source_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "target_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58f5c89c-7ed2-4e14-ac07-6e95da16e2f1",
            "created": "2023-09-28T20:27:33.713Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.046Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58f6af27-8f72-4630-a0d8-27753bc6a5df",
            "created": "2026-09-26T03:37:00.078Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:37:00.078Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--6c7f2661-c4c3-40d6-ac41-2997bc069de9",
            "target_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--58fdcdd1-d3e2-43b4-80a8-8f9ba7f967c2",
            "created": "2026-04-22T20:23:50.776Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.663Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used DynoWiper and built-in commands to destroy data on Mikronika RTUs, Hitachi Relion Protection and Control Relays (IEDs), and HMI workstations.(Citation: CERT Polska)\n\nDuring the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used LazyWiper to destroy data at a manufacturing sector company.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5914a482-dbb7-429d-96f3-77f0588ac12d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "description": "Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d48b79b2-076d-483e-949c-0d38aa347499",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--591620d3-5549-49db-9080-43f86a68a590",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) leverages a previously-unknown vulnerability affecting Tricon MP3008 firmware versions 10.010.4 allows an insecurely-written system call to be exploited to achieve an arbitrary 2-byte write primitive, which is then used to gain supervisor privileges. (Citation: DHS CISA February 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5916d742-2fcf-4421-b3c1-e4370cabfa13",
            "created": "2026-04-22T18:57:02.202Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5924f411-11f0-4ac9-94b5-0f8dec844999",
            "created": "2025-09-29T19:51:26.488Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--592e202e-de91-48df-bbcc-09c9df1851f8",
            "created": "2026-10-07T20:29:56.186Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:29:56.186Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--59685dcb-3076-4171-b43f-0ddca6555dc0",
            "created": "2026-04-23T14:30:09.007Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can modified program logic on Omron PLCs using either the program download or backup transfer functions available through the HTTP server.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5968cbde-b3da-46df-a8bd-a30c2d85363b",
            "created": "2023-09-28T21:28:21.910Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--598386c1-778c-41b7-af1e-e0947651f4ca",
            "created": "2026-04-23T00:27:58.043Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--59a2d15c-f4a4-4df8-ab33-2966db4e2500",
            "created": "2026-09-26T03:01:51.374Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:01:51.374Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--43a670e7-e016-4c29-8ec2-85c18e30f030",
            "target_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--59b53303-e4df-49ec-8e5a-812f2b4265a8",
            "created": "2023-09-29T17:09:25.690Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.047Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--59cb471f-ad8b-464f-ab8f-c267f329b0dc",
            "created": "2023-03-10T20:30:43.206Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.191Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5a43a422-4235-44b8-87e4-bc82e83d44f3",
            "created": "2025-09-24T18:13:43.955Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.936Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5a96d5e3-4c95-4312-a43a-b986d9bb5781",
            "created": "2026-04-22T22:50:54.223Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5a97008b-c23b-4890-ba76-c30cf2a18fba",
            "created": "2023-09-28T20:07:36.295Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5adfe50f-938b-4d8e-885d-0c0ebf43bdcd",
            "created": "2025-09-24T18:21:38.152Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5ae1cf3a-2603-4bf9-ace3-5b1ee5d8d757",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "description": "All field controllers should restrict program uploads to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5ae382ac-27c6-480a-9269-241751553c52",
            "created": "2023-09-28T20:04:54.213Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5b060600-e8b8-4dd8-8ed7-aadbccb8e2a8",
            "created": "2026-04-22T16:04:28.120Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.049Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5b701c8d-374a-4a6b-a695-b5c7a747ceb2",
            "created": "2024-11-20T23:09:31.950Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.050Z",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) can read data from holding registers via Modbus communication.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bad41f1-7a3f-42c6-9b9d-6975212697e2",
            "created": "2025-09-29T21:59:28.930Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.050Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bb313a8-8407-4ec1-a4b0-683ded7f3302",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                },
                {
                    "source_name": "Kyle Wilhoit",
                    "description": "Kyle Wilhoit Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01  ICS Malware: Havex and Black Energy Retrieved. 2019/10/22 ",
                    "url": "https://www.youtube.com/watch?v=eywmb7UDODY&feature=youtu.be&t=939"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.050Z",
            "description": "Execution of [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) relies on a user opening a trojanized installer attached to an email. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) (Citation: Kyle Wilhoit)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bd2b468-10de-4346-80f0-f46f25707069",
            "created": "2025-09-29T19:15:19.909Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.050Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5be1f2b1-75fd-4e7e-901b-495cee4ab5ad",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.520Z",
            "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5beda54d-cd1f-491b-a85e-d7618a0683ad",
            "created": "2024-03-28T14:28:10.742Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.178Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) tripped a controller into a failed safe state, which caused an automatic shutdown of the plant, this resulted in a pause of plant operations for more than a week. Thereby impacting industrial processes and halting productivity.(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bf085ed-b116-4e78-ad79-d5b04fe8b064",
            "created": "2026-10-07T21:53:35.470Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:53:35.470Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bf8473c-3c60-4a8a-8514-c2b50ab8a92d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "description": "Provide the ability to verify the integrity and authenticity of changes to parameter values.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5bfb710a-02bb-4c4a-8f4a-8a7fe66c453f",
            "created": "2023-09-28T20:02:35.354Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5c47a389-30fb-4d42-935d-282c29b67feb",
            "created": "2025-09-29T19:32:38.792Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5c4add91-8956-4d66-a5e9-d17e7ee92cfb",
            "created": "2025-09-29T19:25:44.519Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5c61c8a2-bfff-43fb-8397-bff864413d74",
            "created": "2023-09-29T17:06:09.673Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5c8c8976-2cac-4185-9719-ef55c1032d6a",
            "created": "2024-11-20T23:06:24.432Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.051Z",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) utilizes the Modbus protocol for transmitting commands to victim devices.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5ca1d677-b41f-4f1e-b86b-f5637a418829",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.052Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5d0a7979-0420-4fd1-b5ad-cb5565cbdf9d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.052Z",
            "description": "System and process restarts should be performed when a timeout condition occurs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--98aa0d61-fc9d-4b2d-8f18-b25d03549f53",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5d33de22-35b0-47fa-bc63-f984522340b7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.052Z",
            "description": "Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5d4f6aff-650c-45fe-a9d8-2080d3ea02d7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.052Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5d788a27-a1ba-4f22-aa03-b43875d6ace1",
            "created": "2026-04-23T00:03:16.026Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5d9d7c5d-c455-4bcc-9d2c-80f6746632b9",
            "created": "2025-09-29T19:06:40.704Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5db3a67e-8a3a-479e-a723-fe0f0c9e3563",
            "created": "2025-09-24T18:03:44.816Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5dcf5ba3-bfa8-4aa4-be5f-e5aea64b3591",
            "created": "2023-09-28T19:49:43.417Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5de6bf53-0a02-439b-a8d0-248fa9640a36",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "description": "Audit the integrity of PLC system and application code functionality, such as the manipulation of standard function blocks (e.g., Organizational Blocks) that manage the execution of application logic programs. (Citation: IEC February 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5dfa5bad-8b0b-4884-bf01-04ea89e3ccf7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "description": "Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5e099568-fb5c-4f58-af7e-4e1b7a9d1128",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tom Fakterman August 2019",
                    "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) searches for whether the Ahnlab autoup.exe service is running on the target system and injects its payload into this existing process. (Citation: Tom Fakterman August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5e324da5-0fee-4dac-b289-410d560e03e9",
            "created": "2023-09-28T19:46:49.255Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.053Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5e951a86-1d12-4b14-be4b-7eb4d8fe3a38",
            "created": "2026-10-07T21:15:01.788Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:15:01.788Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5ebb309c-98a9-415a-8c22-2308f69a19b0",
            "created": "2026-04-22T21:42:11.042Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.054Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5ee01089-2ab6-4cf5-a39d-adf72666eceb",
            "created": "2023-09-28T20:16:28.582Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.549Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5f03ee5d-534c-454c-aae3-b41130b00286",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dan Goodin March 2017",
                    "description": "Dan Goodin 2017, March Virtual machine escape fetches $105,000 at Pwn2Own hacking contest Retrieved. 2020/09/25 ",
                    "url": "https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.054Z",
            "description": "Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Dan Goodin March 2017)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5f4badb1-5583-4101-84e4-5b6ebdb0c463",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.055Z",
            "description": "Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5f57e37e-fa3e-4cb6-973e-7e69f61a65c2",
            "created": "2025-09-24T18:24:03.660Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.055Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5f5c38f6-aa3e-4447-a2d3-a76830ab36b0",
            "created": "2023-09-25T20:49:49.605Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.055Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5fd9eaf1-7517-4110-9df1-1e0374a924a9",
            "created": "2026-04-22T20:39:13.266Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.055Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--604a9bf0-81a3-425b-9005-779c4f0f749d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "description": "Harden the system through operating system controls to prevent the known or unknown use of malicious removable media.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9a945a29-5233-4422-a9e3-3e957b0e8bce",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--604e1830-11ac-4ccf-a1d0-b22b80c1b024",
            "created": "2023-09-29T18:07:18.253Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--605dcc44-9e1c-42a9-bc0f-5dfa81444022",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) uses the first COM port from the configuration file for the communication and the other two COM ports are opened to prevent other processes accessing them. This may block processes or operators from getting reporting messages from a device. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--605f3853-b007-4134-8a2d-6a81a35e7676",
            "created": "2023-09-29T18:48:05.559Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6067c069-8e93-4bf0-bb49-97538d55c3de",
            "created": "2024-04-09T20:58:32.884Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6079656e-d391-4de7-aeff-20c0f00f68c3",
            "created": "2026-04-23T00:27:40.717Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.056Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--60e80053-046c-4f53-b1cb-8778cbda8937",
            "created": "2026-04-22T18:55:04.275Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.057Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--60fde424-5a48-4603-9c64-f335a2c6be5a",
            "created": "2026-10-07T21:15:45.543Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:15:45.543Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--610af67a-5e9a-4f10-a88f-d74451e0bac1",
            "created": "2025-09-24T18:13:14.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.057Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6124eea3-34b1-4829-89b7-d837910515e6",
            "created": "2025-09-29T19:54:27.561Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.057Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--61668e93-6d9d-418d-9fbd-2d88c3a66544",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.057Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--61869a8e-d6da-478a-b770-47f97beae8b4",
            "created": "2024-08-15T21:59:43.124Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "NCSC CISA Cyclops Blink Advisory February 2022",
                    "description": "NCSC, CISA, FBI, NSA. (2022, February 23). New Sandworm malware Cyclops Blink replaces VPNFilter. Retrieved March 3, 2022.",
                    "url": "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:32.948Z",
            "description": "[VPNFilter](https://attack.mitre.org/software/S1010) is associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) operations based on reporting on [VPNFilter](https://attack.mitre.org/software/S1010) replacement software, [Cyclops Blink](https://attack.mitre.org/software/S0687).(Citation: NCSC CISA Cyclops Blink Advisory February 2022)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--619b3740-df20-4974-858f-f8067749d7b0",
            "created": "2026-04-23T00:05:26.725Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.058Z",
            "description": "Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6258c355-677c-452d-b1fc-27767232437b",
            "created": "2019-03-26T16:19:52.358Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.284Z",
            "description": "[NotPetya](https://attack.mitre.org/software/S0368) can move laterally through industrial networks by means of the SMB service. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--626eb4df-e9b4-49b8-b59f-35ee63b2d2d9",
            "created": "2026-10-07T21:41:27.737Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:41:27.737Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--62abe387-10a2-414b-881c-060b70db2157",
            "created": "2023-09-28T20:08:39.992Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.059Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--62e818b8-38e6-42ff-9424-9a327332eb2a",
            "created": "2022-09-29T20:02:37.671Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Industroyer",
                    "description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.059Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) IEC 61850 component sends the domain-specific MMSgetNameList request to determine what logical nodes the device supports. It then searches the logical nodes for the CSW value, which indicates the device performs a circuit breaker or switch control function.(Citation: ESET Industroyer)\n\n[Industroyer](https://attack.mitre.org/software/S0604)'s OPC DA module also uses IOPCBrowseServerAddressSpace to look for items with the following strings: ctlSelOn, ctlOperOn, ctlSelOff, ctlOperOff, Pos and stVal.(Citation: ESET Industroyer)\n\n[Industroyer](https://attack.mitre.org/software/S0604) IEC 60870-5-104 module includes a range mode to discover Information Object Addresses (IOAs) by enumerating through each.(Citation: ESET Industroyer)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--630eb861-eb37-4258-9dbd-87789df2257a",
            "created": "2024-03-26T15:41:26.772Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.060Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--632ca9a0-a9f3-4b27-96e1-9fcb8bab11cb",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:35.536Z",
            "relationship_type": "revoked-by",
            "source_ref": "intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6",
            "target_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--63323b12-86db-4b91-a701-90daf3f98f7c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.060Z",
            "description": "Segment networks and systems appropriately to reduce access to critical system and services communications.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--63453d2f-30f6-40ab-b32c-506d940ecd20",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.060Z",
            "description": "Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--636a70d1-dd76-4633-b960-e64459f87299",
            "created": "2026-04-22T22:53:08.394Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.060Z",
            "description": "Ensure systems and devices have an alternative method for communicating in the event that Wi-Fi communication channels become unavailable.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--639148fb-d0a5-4a2f-b6a3-a5ceb83d620b",
            "created": "2023-09-29T17:44:55.599Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.060Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--63be361c-72a7-4a17-923e-f7c957c29ae0",
            "created": "2026-09-25T19:15:26.200Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:15:26.200Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--63ca148e-12c9-4090-b51e-a8fb7a847a2a",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                },
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.061Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009)'s argument-setting and inject.bin shellcode are added to the program table on the Tricon so that they are executed by the firmware once each cycle. (Citation: DHS CISA February 2019) (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--63f863e5-7c00-4474-8e43-bbe8bfb05cc3",
            "created": "2023-09-29T16:43:05.495Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.061Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6420b4b9-3536-4a9b-b53d-6780242f38cf",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--de675cf4-144e-485c-a761-c72ebcb9e2bc",
            "target_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6421e980-4f75-4e13-a207-a9583bd28c4a",
            "created": "2026-04-22T20:42:33.462Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.061Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--642cae89-bb5c-46f3-9fea-8d747b930c35",
            "created": "2023-03-10T20:11:10.018Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.199Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. The raw sewage affected local parks, rivers, and even a local hotel. This resulted in harm to marine life and produced a sickening stench from the community's affected rivers.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--642f4d65-04ea-4662-bc1c-5fba12aa4fc1",
            "created": "2026-04-23T16:45:04.370Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.061Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--645d5380-c5e5-4ee6-8ebb-11a0cd44cc08",
            "created": "2026-04-23T16:29:09.403Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.061Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--64db6a39-64d2-4999-97d7-91c28c32f42e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.062Z",
            "description": "Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid messages.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--64ebfc98-f9ad-40bd-9fe4-9e7fd9ffd2cf",
            "created": "2026-10-07T20:38:23.174Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:38:23.174Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--64f14b30-f71e-4429-b16e-160ae5e346f0",
            "created": "2025-09-24T18:20:25.164Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.062Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--64f31c4f-a525-469c-8f2f-370dcd321314",
            "created": "2023-10-02T20:21:16.665Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.062Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--650bca94-b9ad-45dd-90c9-83481247711a",
            "created": "2025-09-29T22:02:00.622Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.062Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--652a68a2-a26b-4e8c-86dd-fd83187ed043",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.063Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--652c1e77-cfea-4452-9762-5ba16f874119",
            "created": "2023-09-29T17:58:42.002Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.948Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6573327e-3757-424e-8570-04ffe7d5d0e2",
            "created": "2023-09-27T14:53:25.385Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.561Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) used port 443 to communicate with their C2 servers. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65aa5a0d-926c-4b04-9509-f66a99639877",
            "created": "2023-09-29T17:41:34.892Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.063Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65ab0305-9fe2-4af4-a11e-b8d272493ad1",
            "created": "2026-04-22T20:37:52.099Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.063Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65adbdda-7069-40ed-9825-b79ec87e4916",
            "created": "2021-09-21T15:47:37.522Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CrowdStrike Carbon Spider August 2021",
                    "description": "Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.",
                    "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
                },
                {
                    "source_name": "Microsoft Ransomware as a Service",
                    "description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
                },
                {
                    "source_name": "IBM Ransomware Trends September 2020",
                    "description": "Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.",
                    "url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
                },
                {
                    "source_name": "FBI Flash FIN7 USB",
                    "description": "The Record. (2022, January 7). FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware. Retrieved January 14, 2022.",
                    "url": "https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:31.959Z",
            "description": "(Citation: IBM Ransomware Trends September 2020)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: FBI Flash FIN7 USB)(Citation: Microsoft Ransomware as a Service)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
            "target_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65b57405-c7f6-432b-83ac-9571563250db",
            "created": "2026-09-25T16:43:43.575Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                },
                {
                    "source_name": "Nozomi BUSTLEBERM 2024",
                    "description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
                    "url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T16:43:43.575Z",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) is compiled for Windows systems and leverages a Windows-based command line interface.(Citation: Dragos FROSTYGOOP 2024) Modbus interaction functionality is based off a publicly available Github repository for command line input.(Citation: Nozomi BUSTLEBERM 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65d42e15-749b-4f86-86c5-b9f1da1e60c5",
            "created": "2023-09-28T21:25:34.304Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.063Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--65e25631-05de-4ce2-88cc-52f91cfbdaf2",
            "created": "2023-10-02T20:18:54.267Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.961Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6603a100-d655-4e6b-8d38-73c11b89dde4",
            "created": "2019-03-26T16:19:52.358Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.064Z",
            "description": "[NotPetya](https://attack.mitre.org/software/S0368) initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6637d8e6-6578-4d15-a993-d63ced4c4464",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.064Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--665587ee-1524-4334-9580-2b448c417542",
            "created": "2023-03-30T19:26:07.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Mandiant April 2022",
                    "description": "Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.",
                    "url": "https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"
                },
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.064Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) modifies specified Information Object Addresses (IOAs) for specified Application Service Data Unit (ASDU) addresses to either the ON or OFF state.(Citation: Industroyer2 Mandiant April 2022)(Citation: Industroyer2 Forescout July 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6681bc38-0b55-4714-b690-c609956b40bf",
            "created": "2022-09-28T20:27:33.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.064Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045)  can brute force password-based authentication to Schneider PLCs over  the CODESYS protocol (UDP port 1740).(Citation: CISA-AA22-103A)\n\n [INCONTROLLER](https://attack.mitre.org/software/S1045)  can perform brute force guessing of passwords to OPC UA servers using a predefined list of passwords.(Citation: CISA-AA22-103A)(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--668f8c4b-225a-4287-ac5b-7717a4f75b5d",
            "created": "2023-03-10T20:32:02.472Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.210Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed for changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--66af47d7-c430-4ac9-8020-fd79b7059037",
            "created": "2022-09-28T20:28:03.422Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can use the FINS (Factory Interface Network Service) protocol to scan for and obtain MAC address associated with Omron devices.(Citation: CISA-AA22-103A)(Citation: Wylie-22)",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--66d041e2-d9e8-46cc-88ee-8e5c1cec8702",
            "created": "2023-09-29T17:43:31.956Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--66d8f3d7-68e0-48a0-a563-4746922080fc",
            "created": "2024-04-09T20:48:46.756Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--66eb9d6f-498b-4a9a-94d3-fe808460bb68",
            "created": "2024-09-11T22:50:15.550Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) initial execution relied on accessing external remote services for victim environments.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--66f79019-d52c-46a6-b605-c2335d1d3d20",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) has the capability to stop a service itself, or to login as a user and stop a service as that user. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--671043a9-337f-411a-9ca9-3112e897ab09",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--672329b4-2695-4373-a2e4-0fc16c75cc13",
            "created": "2025-09-24T18:12:25.320Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.065Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--674a508f-ac54-41a8-9820-4a18c0ea86e4",
            "created": "2026-10-07T19:38:22.540Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:38:22.540Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6754195a-99cd-4b45-bafd-4a374ae79bbd",
            "created": "2023-09-29T18:02:52.119Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67761911-5a46-445b-bf5e-a266330910b5",
            "created": "2026-10-07T21:21:43.311Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:21:43.311Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6795c92f-848f-488e-9c25-d240f99c9b34",
            "created": "2023-09-28T21:23:39.333Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6797d89b-c631-4a45-90b8-7da2c703b6e7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--9ad17e7a-5920-42ac-9bf4-545b99162640",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--679e7b8d-57d7-4c1d-8f42-1496606ea666",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jeff Jones May 2018",
                    "description": "Jeff Jones 2018, May 10 Dragos Releases Details on Suspected Russian Infrastructure Hacking Team ALLANITE Retrieved. 2020/01/03 ",
                    "url": "https://www.eisac.com/public-news-detail?id=115909"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.007Z",
            "description": "[ALLANITE](https://attack.mitre.org/groups/G1000) utilized spear phishing to gain access into energy sector environments. (Citation: Jeff Jones May 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67a85278-577c-4e8a-a668-83f43edb9742",
            "created": "2026-09-25T18:09:29.505Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:09:29.505Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67ae8423-c401-4c11-93d3-0454c288d934",
            "created": "2023-09-29T16:31:57.421Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67dae594-4239-4756-a0bc-dee75de19e4c",
            "created": "2023-09-29T17:07:14.259Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67dd6b59-ef78-4732-beb8-4917156b6382",
            "created": "2026-04-22T20:18:36.361Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67e11f38-9f68-4989-8de3-da65af52063e",
            "created": "2023-03-30T19:24:54.896Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 ESET April 2022",
                    "description": "ESET. (2022, April 12). Industroyer2: Industroyer reloaded. Retrieved March 30, 2023.",
                    "url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"
                },
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.066Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) has the capability to poll a target device about its connection status, data transfer status, Common Address (CA), Information Object Addresses (IOAs), and IO state values across multiple priority levels.(Citation: Industroyer2 Forescout July 2022)(Citation: Industroyer2 ESET April 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--67ed5edc-fd57-4b1c-9677-8f0758154526",
            "created": "2025-09-29T19:04:04.581Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.973Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6833d534-9cbb-4b9f-85b6-93d3d2d6faca",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.067Z",
            "description": "Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--685249f9-e51a-4914-8b7f-09679e04198b",
            "created": "2023-09-28T19:49:11.359Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.067Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--686cbd74-ef49-4e77-9599-21777d3a4738",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.067Z",
            "description": "Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid messages.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6895e54e-3968-41a9-9013-a082cd46fa44",
            "created": "2020-05-14T14:40:26.221Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Red Canary Hospital Thwarted Ryuk October 2020",
                    "description": "Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.",
                    "url": "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"
                },
                {
                    "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
                    "description": "DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
                },
                {
                    "source_name": "CrowdStrike Ryuk January 2019",
                    "description": "Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.",
                    "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
                },
                {
                    "source_name": "FireEye KEGTAP SINGLEMALT October 2020",
                    "description": "Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.",
                    "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
                },
                {
                    "source_name": "Microsoft Ransomware as a Service",
                    "description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
                    "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
                },
                {
                    "source_name": "CrowdStrike Wizard Spider October 2020",
                    "description": "Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.",
                    "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
                },
                {
                    "source_name": "Sophos New Ryuk Attack October 2020",
                    "description": "Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.",
                    "url": "https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"
                },
                {
                    "source_name": "Mandiant FIN12 Oct 2021",
                    "description": "Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.",
                    "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
                },
                {
                    "source_name": "DFIR Ryuk 2 Hour Speed Run November 2020",
                    "description": "The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.",
                    "url": "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"
                },
                {
                    "source_name": "DFIR Ryuk in 5 Hours October 2020",
                    "description": "The DFIR Report. (2020, October 18). Ryuk in 5 Hours. Retrieved October 19, 2020.",
                    "url": "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/"
                },
                {
                    "source_name": "DFIR Ryuk's Return October 2020",
                    "description": "The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.",
                    "url": "https://thedfirreport.com/2020/10/08/ryuks-return/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:50.259Z",
            "description": "(Citation: CrowdStrike Ryuk January 2019)(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)(Citation: DFIR Ryuk in 5 Hours October 2020)(Citation: Sophos New Ryuk Attack October 2020)(Citation: CrowdStrike Wizard Spider October 2020)(Citation: Mandiant FIN12 Oct 2021)(Citation: Microsoft Ransomware as a Service)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
            "target_ref": "malware--a020a61c-423f-4195-8c46-ba1d21abba37",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--68e0f740-e04d-492c-b735-ce75f86a62f5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--e9f6c9ad-7368-43e3-9ba1-c9261323a1d1",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--692240ba-667e-4f37-9f35-f354240c5bdc",
            "created": "2023-09-29T16:46:50.699Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.068Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--692324b4-064a-430c-8ffc-7f7acd537778",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec W32.Duqu",
                    "description": "Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.",
                    "url": "https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-06-12T16:01:16.020Z",
            "description": "[Duqu](https://attack.mitre.org/software/S0038) downloads additional modules for the collection of data in information repositories, including the Infostealer 2 module that can access data from Windows Shares.(Citation: Symantec W32.Duqu)",
            "relationship_type": "uses",
            "source_ref": "malware--68dca94f-c11d-421e-9287-7c501108e18c",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--692ff921-c74d-40a4-ab31-879aba5f247a",
            "created": "2023-09-29T16:42:01.287Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.068Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69576d3c-d0e8-459e-9f2e-0b9c560b2e04",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.068Z",
            "description": "Example mitigations could include minimizing its distribution/storage or obfuscating the information (e.g., facility coverterms, codenames).  In many cases this information may be necessary to support critical engineering, maintenance, or operational functions, therefore, it may not be feasible to implement.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--99c746d7-a08a-4169-94f9-b8c0dad716fa",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69889c90-e6d0-4007-9078-2bfbd7c18a91",
            "created": "2024-03-25T20:11:07.813Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                },
                {
                    "source_name": "Jamie Tarabay and Katrina Manson December 2023",
                    "description": "Jamie Tarabay and Katrina Manson. (2023, December 22). Iranian-Linked Hacks Expose Failure to Safeguard US Water System. Retrieved March 25, 2024.",
                    "url": "https://www.bloomberg.com/news/articles/2023-12-22/iranian-linked-hacks-expose-failure-to-safeguard-us-water-system"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.836Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) replaced the existing graphic on the [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002) with their own, thereby preventing PLC owners and operators from viewing PLC information on the HMI.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: Jamie Tarabay and Katrina Manson December 2023) ",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--698d7c50-daab-4087-a7b4-b2bc8dfd81a7",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.069Z",
            "description": "Provide the ability to verify the integrity of controller tasking. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used. (Citation: IEC February 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69963190-c0a1-4518-922f-0f6153e1f6a6",
            "created": "2026-04-23T00:02:50.392Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.069Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69cf4015-fae1-47f6-9253-1f99209288a5",
            "created": "2023-09-29T16:27:34.964Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.069Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69d19946-72fb-40ce-90fb-0757df8353b5",
            "created": "2024-11-20T23:05:29.090Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.574Z",
            "description": "[FrostyGoop](https://attack.mitre.org/software/S1165) communicates using the Modbus protocol over the standard port of TCP 502.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69f5ca66-8334-47e1-920e-b9320e007c3b",
            "created": "2025-09-24T17:56:30.277Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.069Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--69f9597e-a47d-49bb-a182-376349f979ef",
            "created": "2026-04-22T13:31:06.137Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.069Z",
            "description": "Provide an alternative method for sending critical commands message to outstations, this could include using radio/cell communication to send messages to a field technician that physically performs the control function.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6a314797-9105-44e3-be5f-41b817454daf",
            "created": "2026-04-23T00:27:00.713Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.070Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6a34bec1-cb83-4af8-ae74-701f299e634d",
            "created": "2026-10-07T20:20:39.700Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:20:39.700Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6a476f56-2c07-43be-8054-d978ee8eb924",
            "created": "2023-09-29T16:42:12.160Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.070Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ad39b3a-a962-457f-852c-be7fc615e22f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.070Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ad3b5cc-7ba1-4287-8c05-d02385f84f72",
            "created": "2023-09-29T16:31:22.789Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.070Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6b0e8f60-ecdf-4140-9741-5b50df67353c",
            "created": "2024-03-25T20:06:37.050Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                },
                {
                    "source_name": "Lisa Zahner December 2023",
                    "description": "Lisa Zahner. (2023, December 15). Hackers in Iran attack computer at Vero Utilities. Retrieved March 25, 2024.",
                    "url": "https://veronews.com/2023/12/15/hackers-in-iran-attack-computer-at-vero-utilities/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.844Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) exploited devices connected to the public internet, such as internet connected Unitronics [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002) and networking equipment such as cellular modems found in OT environments.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: Lisa Zahner December 2023)",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6b33ae4d-2c8b-434f-994e-7e0b1413ff2c",
            "created": "2025-09-29T19:12:03.315Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.071Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6b5d2643-b399-43aa-8ab1-7557a0446b07",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.071Z",
            "description": "Only authorized personnel should be able to change settings for alarms.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6b5fd6d8-ef70-4896-b1a4-7b6c29c3a0d4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.071Z",
            "description": "All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6bbb12c3-171d-45a5-a01b-a74b0c0704f0",
            "created": "2026-04-22T16:02:56.600Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "description": "Perform integrity checks of firmware before uploading it on a device. Utilize cryptographic hashes to verify the firmware has not been tampered with by comparing it to a trusted hash of the firmware. This could be from trusted data sources (e.g., vendor site) or through a third-party verification service.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6be4cef2-3d54-4cd8-97df-8a8b37c03605",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "description": "Utilize central storage servers for critical operations where possible (e.g., historians) and keep remote backups. For outstations, use local redundant storage for event recorders. Have backup control system platforms, preferably as hot-standbys to respond immediately to data destruction events. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6c15ec9f-2b48-419c-adc1-f989833f6187",
            "created": "2021-10-14T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "description": "Install anti-virus software on all workstation and transient assets that may have external access, such as to web, email, or remote file shares.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6c20bab8-3b4d-4cbc-83f5-ad032c7ecde3",
            "created": "2026-04-22T13:45:46.984Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6c31c795-935a-41ad-8db1-d74430f4a553",
            "created": "2023-09-29T18:56:59.151Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6c470aa0-b119-4078-80fc-2b66a4d6eac4",
            "created": "2023-09-28T20:09:36.756Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.072Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6c9c1c11-c996-4d2b-bbed-d73ae30efd2e",
            "created": "2023-09-28T20:08:52.975Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.073Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6cce7a41-335a-4481-a574-1d0cc75cd6b4",
            "created": "2026-10-07T21:46:54.383Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:46:54.383Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ce3bd17-de4c-4ff3-9f7d-ae30efae2b58",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.073Z",
            "description": "In [Industroyer](https://attack.mitre.org/software/S0604) the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6d1906b4-e815-4688-86f1-ce61d403f8c6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.074Z",
            "description": "All remote services should require strong authentication before providing user access.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6d822f86-5793-403a-b176-5d533f6b81b3",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.074Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) RAT is distributed through trojanized installers planted on compromised vendor sites. (Citation: Daavid Hentunen, Antti Tikkanen June 2014)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6dcbeaa1-5254-4a6a-a34d-07f6dc874a13",
            "created": "2026-10-07T20:31:32.049Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:31:32.049Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6e37ae60-f8db-4305-8235-8711c6cb8a4a",
            "created": "2025-09-29T19:16:08.208Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.075Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6e5b9baf-8d51-4b1e-a0c4-09d4da904160",
            "created": "2026-04-22T18:57:49.234Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.075Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6eafa3e9-f53f-43b5-ac24-1415b05b537f",
            "created": "2024-03-26T15:42:22.024Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.076Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ec8c4c2-9bfc-43ef-a634-f43cb951e06e",
            "created": "2026-04-22T20:24:39.993Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.076Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ed07095-c23a-4676-807f-a544deaeb274",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "McAfee Labs October 2019",
                    "description": "McAfee Labs 2019, October 02 McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service  What The Code Tells Us Retrieved. 2021/04/12 ",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us"
                },
                {
                    "source_name": "SecureWorks September 2019",
                    "description": "SecureWorks 2019, September 24 REvil/Sodinokibi Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.076Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) sends exfiltrated data from the victims system using HTTPS POST messages sent to the C2 system. (Citation: McAfee Labs October 2019) (Citation: SecureWorks September 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f0384e6-73c8-4fc7-bc0c-0a8c2bfa473d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.076Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f122824-1a91-4717-aaf6-3db95d04bca1",
            "created": "2026-10-07T20:31:51.956Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:31:51.956Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f1479d9-dfd4-4baa-abd5-9847781ef9bf",
            "created": "2023-09-29T17:41:50.116Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.076Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f269b4c-b338-4b62-8a1a-f08268999b5c",
            "created": "2026-04-23T00:01:57.093Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f2c2043-6487-467a-bb49-e8cd2509ae9f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "description": "Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and public disclosure.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f2ddada-d7df-4788-b5d1-9add185142e0",
            "created": "2023-09-28T20:02:57.330Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f72c60e-2739-40b6-b6a9-66d2a3d1833e",
            "created": "2023-09-28T21:27:14.172Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f815d4c-0512-4d92-bcdf-068034233048",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "description": "Implement network allowlists to minimize serial comm port access to only authorized hosts, such as comm servers and RTUs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f950c91-125b-46a0-aa40-239b4de2306a",
            "created": "2023-09-28T21:14:03.305Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.077Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6f9e3f69-ac1c-479e-ae2d-73dd1413d4dd",
            "created": "2024-09-11T23:00:00.833Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.078Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) repeatedly wrote arbitrary data over the Meter-Bus channel from impacted devices to connected sensors to render sensor data acquisition useless.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6fa3aee4-2a29-4c0f-9e61-1f7df5eccc00",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.078Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) may manipulate any outputs of the PLC. Using the POU POKE any value within the process image may be modified. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6fb4c5ec-4079-4419-a098-6e3cf026c360",
            "created": "2023-09-27T14:54:12.586Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.898Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) overwrote the serial-to-ethernet converter firmware, rendering the devices not operational. This meant that communication to the downstream serial devices was either not possible or more difficult. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6ff846b1-9444-45f1-837a-4eeeb16bdfe7",
            "created": "2023-03-30T19:25:22.673Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.078Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) leverages a hardcoded list of remote-station IP addresses to iteratively initiate communications and collect information across multiple priority IEC-104 priority levels.(Citation: Industroyer2 Forescout July 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--703adc98-d4d1-409e-bf20-4e65921ae52f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.078Z",
            "description": "Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid reporting messages.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7041d8e5-3b74-402a-86b3-fd59def80632",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.078Z",
            "description": "Hot-standbys in diverse locations can ensure continued operations if the primarily system are compromised or unavailable. At the network layer, protocols such as the Parallel Redundancy Protocol can be used to simultaneously use redundant and diverse communication over a local network. (Citation: M. Rentschler and H. Heine)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7050acd5-637b-4581-b58e-dcfac3eb1bb5",
            "created": "2026-10-08T21:35:55.577Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-08T21:35:55.577Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary logged in to internet-exposed PLCs using default credentials.(Citation: Tenable Minnesota Water Utilities)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--706bf21c-0722-43b3-8729-60370f648796",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--e69d1e15-76e1-434c-bd45-0354a10dde8a",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--706cdbae-6bb6-42c5-8d15-2f066cc3b19c",
            "created": "2026-10-07T20:18:49.448Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:18:49.448Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--70e47417-e7ae-4558-8382-6582e897869c",
            "created": "2026-09-25T19:12:31.959Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:12:31.959Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71422483-33e4-4131-a4ec-40322d91d8a0",
            "created": "2019-06-24T17:20:24.258Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Catalin Cimpanu April 2016",
                    "description": "Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 ",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                },
                {
                    "source_name": "Symantec June 2015",
                    "description": "Symantec 2015, June 30 Simple steps to protect yourself from the Conficker Worm Retrieved. 2019/12/05 ",
                    "url": "https://support.symantec.com/us/en/article.tech93179.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.080Z",
            "description": "[Conficker](https://attack.mitre.org/software/S0608) exploits Windows drive shares. Once it has infected a computer, [Conficker](https://attack.mitre.org/software/S0608) automatically copies itself to all visible open drive shares on other computers inside the network. (Citation: Symantec June 2015) Nuclear power plant officials suspect someone brought in [Conficker](https://attack.mitre.org/software/S0608) by accident on a USB thumb drive, either from home or computers found in the power plant's facility. (Citation: Catalin Cimpanu April 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71a2c3f5-7383-4bd8-a830-dc2aae62a977",
            "created": "2023-09-28T19:55:37.459Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.080Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71a8d11d-a5ef-4025-819a-2627e4fe7b04",
            "created": "2026-10-07T21:41:02.904Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:41:02.904Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71c9db9c-6f0c-4e33-a20a-dcd5b791a49a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.081Z",
            "description": "Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71e9230d-eec8-4ce1-bc96-9288bacc8b13",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.081Z",
            "description": "To protect against AiTM, authentication mechanisms should not send credentials across the network in plaintext and should also implement mechanisms to prevent replay attacks (such as nonces or timestamps). Challenge-response based authentication techniques that do not directly send credentials over the network provide better protection from AiTM.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--71f61677-4406-4484-bacb-c8de82c7e1bd",
            "created": "2026-04-22T14:33:24.324Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:57.949Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--f487a605-0acb-4b12-b157-33b75ebd9a40",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7200f777-0ddd-4c9c-a022-26d49ea524d3",
            "created": "2024-09-11T23:00:48.583Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.081Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) impaired sensor communication to impacted devices resulting in a loss of view condition for overall system monitoring.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7258c355-677c-452d-b1fc-27767232437b",
            "created": "2019-03-26T16:19:52.358Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "David Voreacos, Katherine Chinglinsky, Riley Griffin December 2019",
                    "description": "David Voreacos, Katherine Chinglinsky, Riley Griffin 2019, December 03 Merck Cyberattacks $1.3 Billion Question: Was It an Act of War? Retrieved. 2019/12/06 ",
                    "url": "https://www.bloomberg.com/news/features/2019-12-03/merck-cyberattack-s-1-3-billion-question-was-it-an-act-of-war"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.081Z",
            "description": "[NotPetya](https://attack.mitre.org/software/S0368) disrupted manufacturing facilities supplying vaccines, resulting in a halt of production and the inability to meet demand for specific vaccines. (Citation: David Voreacos, Katherine Chinglinsky, Riley Griffin December 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--72848957-910f-4fa5-8a59-383c0a9dae62",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.082Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--72a284ef-1b88-40b1-8ab0-af6e2911f7cd",
            "created": "2026-09-25T18:36:04.994Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tom Fakterman August 2019",
                    "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:36:04.994Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. (Citation: Tom Fakterman August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--730580d4-d68c-407f-9d09-f379e9aefc7e",
            "created": "2023-03-30T19:25:41.475Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.082Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) uses a General Interrogation command to monitor the device’s Information Object Addresses (IOAs) and their IO state values.(Citation: Industroyer2 Forescout July 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73093c08-ea39-4956-8bff-55e15f6630cd",
            "created": "2023-09-28T20:07:59.785Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.082Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7318e20b-4f7e-4ba5-b293-b759f7a2e3c7",
            "created": "2026-10-07T20:07:30.151Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:07:30.151Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73856fa4-5abb-4341-bf51-1874cc1e6c26",
            "created": "2026-04-22T20:25:39.530Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.758Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries corrupted the firmware in the Hitachi RTUs resulting in a fault that triggered a reboot loop.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73c358d5-f4ce-4ce5-aa3d-d2ede8aff148",
            "created": "2024-03-25T20:17:16.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.083Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73dbe470-0d10-493b-b0ae-241da7dc0b58",
            "created": "2026-04-22T17:59:55.913Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.536Z",
            "description": "Use network intrusion detection/prevention systems to detect and prevent port scans.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73eaa82f-9ab0-430d-86b8-64ea85b18c91",
            "created": "2024-03-28T14:29:46.095Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON 2018",
                    "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.195Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) leveraged [Triton](https://attack.mitre.org/software/S1009) to send unauthorized command messages to the Triconex safety controllers.(Citation: FireEye TRITON 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73eaaabd-7c35-46d1-8ca7-df185a5d1cff",
            "created": "2026-10-07T20:37:45.282Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:37:45.282Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73ed52f4-4a98-47e7-84bf-5eae555d999d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.084Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--740082b7-2411-473a-a59d-4d46cf12f8b5",
            "created": "2023-09-29T18:45:01.516Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.084Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7411b05d-209a-4907-83ce-00ab1538fbac",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "University of Birmingham C2",
                    "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
                    "url": "https://arxiv.org/pdf/1408.1136"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.547Z",
            "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.(Citation: University of Birmingham C2)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--745b5268-f2b3-499c-a6a4-63d7e8667ff7",
            "created": "2023-09-29T17:57:23.090Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.084Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--74a6f16c-3a23-4cac-8592-fc363960f9df",
            "created": "2026-04-22T20:17:57.960Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.085Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--74b66248-2cb6-46ea-b52c-c7d60c170f3f",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "MDudek-ICS",
                    "description": "MDudek-ICS   TRISIS-TRITON-HATMAN Retrieved. 2019/11/03 ",
                    "url": "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.085Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) has the ability to halt or run a program through the TriStation protocol. TsHi.py contains instances of halt and run functions being executed.(Citation: MDudek-ICS)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--74ec9ce5-3155-488c-ae56-570c47a1d207",
            "created": "2021-04-13T12:45:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "D. Parsons and D. Wylie September 2019",
                    "description": "D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25 ",
                    "url": "https://www.csiac.org/journal-article/practical-industrial-control-system-ics-cybersecurity-it-and-ot-have-converged-discover-and-defend-your-assets/"
                },
                {
                    "source_name": "Colin Gray",
                    "description": "Colin Gray D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25  How SDN Can Improve Cybersecurity in OT Networks Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6891_HowSDN_CG_20180720_Web2.pdf?v=20190312-231901"
                },
                {
                    "source_name": "Josh Rinaldi April 2016",
                    "description": "Josh Rinaldi 2016, April Still a Thrill: OPC UA Device Discovery Retrieved. 2020/09/25 ",
                    "url": "https://www.rtautomation.com/rtas-blog/still-a-thrill-opc-ua-device-discovery/"
                },
                {
                    "source_name": "Aditya K Sood July 2019",
                    "description": "Aditya K Sood 2019, July Discovering and fingerprinting BACnet devices Retrieved. 2020/09/25 ",
                    "url": "https://www.helpnetsecurity.com/2019/07/10/bacnet-devices/"
                },
                {
                    "source_name": "Langner November 2018",
                    "description": "Langner 2018, November Why Ethernet/IP changes the OT asset discovery game Retrieved. 2020/09/25 ",
                    "url": "https://www.langner.com/2018/11/why-ethernet-ip-changes-the-ot-asset-discovery-game/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.085Z",
            "description": "ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols. (Citation: D. Parsons and D. Wylie September 2019) (Citation: Colin Gray) Examples of automation protocols with discovery capabilities include OPC UA Device Discovery  (Citation: Josh Rinaldi April 2016), BACnet  (Citation: Aditya K Sood July 2019), and Ethernet/IP. (Citation: Langner November 2018)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--751ee4bc-6b32-4c3d-b8c0-f73f9295ddd2",
            "created": "2026-10-07T21:54:40.895Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:54:40.895Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--754521fc-4306-4daa-831b-6b6fb45847e2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "MITRE June 2020",
                    "description": "MITRE 2020, June CWE CATEGORY: 7PK - API Abuse Retrieved. 2020/09/25 ",
                    "url": "https://cwe.mitre.org/data/definitions/227.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.085Z",
            "description": "All APIs used to perform execution, especially those hosted on embedded controllers (e.g., PLCs), should provide adequate authorization enforcement of user access. Minimize user's access to only required API calls. (Citation: MITRE June 2020)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7584e57f-1258-4c47-b18d-99019a586e6c",
            "created": "2023-09-28T21:16:35.382Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--758773e3-d23d-44db-b5d3-643cde5b41f1",
            "created": "2023-09-28T19:45:07.511Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--758d5818-f919-4a6b-9dc2-a212595a11bd",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75911ed1-3cd0-485d-8130-3aae06712f4a",
            "created": "2026-04-22T13:48:07.154Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75b17842-7614-4c52-9a78-db096f8b653c",
            "created": "2025-09-29T21:56:50.121Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75c27f4e-d1e3-490a-9793-a6fc8e326a48",
            "created": "2023-09-29T17:06:33.098Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75e6adae-06a7-47e9-878e-74ca73004c3b",
            "created": "2023-09-28T20:30:01.641Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.086Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75f486d8-c651-40ba-8e2e-81ee6c924ffc",
            "created": "2025-09-29T21:56:11.885Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.087Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--76537fd7-5782-4a8d-9b54-117b168a4306",
            "created": "2023-09-29T16:38:51.155Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.087Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--768b6ce0-8b1c-4424-a9e7-ee659a948fa9",
            "created": "2025-09-24T18:20:40.018Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.087Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--76c3caa4-bc2a-437d-9826-3d32a78ff76a",
            "created": "2026-09-26T05:33:08.385Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dispel Iran Water Utilities",
                    "description": "Connor Hazen. (2026, July 31). When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door” . Retrieved September 26, 2026.",
                    "url": "https://dispel.com/blog/minnesota-water-utility-attacks-secure-remote-access-ot"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:40:17.349Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) accessed internet-accessible equipment using default credentials.(Citation: Tenable Minnesota Water Utilities)(Citation: Dispel Iran Water Utilities) ",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--76cf41a1-f340-401c-b640-bf7fe5143f56",
            "created": "2025-09-29T19:47:36.964Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.088Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--77566f94-5e26-41c9-892f-2f62b395afe7",
            "created": "2023-09-28T20:01:43.057Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.088Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--779d3d69-f079-4bee-b7ac-3d5164b9ec6d",
            "created": "2026-04-22T20:23:55.959Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.089Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--77f3a64d-227d-487f-8484-89007e05b59f",
            "created": "2023-09-28T21:16:14.153Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.089Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--78881a3d-59ad-4fbb-8bd2-69388a068584",
            "created": "2023-09-29T18:01:45.518Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.090Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--792324b4-064a-430c-8ffc-7f7acd537778",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec W32.Duqu",
                    "description": "Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.",
                    "url": "https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-06-12T16:02:27.291Z",
            "description": "[Duqu](https://attack.mitre.org/software/S0038)'s purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party.(Citation: Symantec W32.Duqu)",
            "relationship_type": "uses",
            "source_ref": "malware--68dca94f-c11d-421e-9287-7c501108e18c",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79235599-e23f-43cb-9c56-1eb22b7c4664",
            "created": "2023-09-29T16:38:38.201Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79259f05-a677-4512-bb57-8c3137d303ba",
            "created": "2026-04-22T21:41:30.908Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79324bdd-cdab-4d0a-af60-af1047c1d117",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79407d1e-8e16-48c1-939c-ad92f91dd988",
            "created": "2023-09-29T16:30:19.141Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79516dd8-72de-4372-bfce-b7f4a98b98d7",
            "created": "2023-09-28T20:11:42.579Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7978037f-e332-4b31-9b6f-c3f5719f735b",
            "created": "2026-10-07T21:21:09.762Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:21:09.762Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--798919d3-df8b-463f-b2be-4c1aa8089384",
            "created": "2021-10-14T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "North America Transmission Forum December 2019",
                    "description": "North America Transmission Forum 2019, December NATF Transient Cyber Asset Guidance Retrieved. 2020/09/25 ",
                    "url": "https://www.natf.net/docs/natf/documents/resources/security/natf-transient-cyber-asset-guidance.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "description": "Segment and control software movement between business and OT environments by way of one directional DMZs. Web access should be restricted from the OT environment. Engineering workstations, including transient cyber assets (TCAs) should have minimal connectivity to external networks, including Internet and email, further limit the extent to which these devices are dual-homed to multiple networks. (Citation: North America Transmission Forum December 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--798de2f3-218b-4622-a62c-84e3840d45a6",
            "created": "2023-09-29T18:00:10.845Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.091Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--799951e5-ab80-4b13-a136-7fbcab4e19af",
            "created": "2026-04-22T22:47:57.090Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.092Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79c6d710-baf4-411e-a3f5-9cb8d42b7c19",
            "created": "2023-09-29T16:32:22.510Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.092Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79d05cb2-ded0-4847-b52e-af7af421f303",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Kevin Savage and Branko Spasojevic",
                    "description": "Kevin Savage and Branko Spasojevic   W32.Flamer Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20190930124504/https:/www.symantec.com/security-center/writeup/2012-052811-0308-99"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.092Z",
            "description": "[Flame](https://attack.mitre.org/software/S0143) can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information. (Citation: Kevin Savage and Branko Spasojevic)",
            "relationship_type": "uses",
            "source_ref": "malware--ff6840c9-4c87-4d07-bbb6-9f50aa33d498",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7a19d6d4-19dd-4058-b1bf-28a7c41ee4b1",
            "created": "2026-09-25T20:29:33.330Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Robert Falcone, Bryan Lee May 2016",
                    "description": "Robert Falcone, Bryan Lee 2016, May 26 The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor Retrieved. 2019/11/19 ",
                    "url": "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:29:33.330Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.(Citation: Robert Falcone, Bryan Lee May 2016)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7a29d34a-08fd-4aeb-8968-22856ad7429a",
            "created": "2026-04-22T22:31:56.959Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.092Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7a3fbac8-c666-4564-b02a-ea199bbcb2a5",
            "created": "2023-09-28T20:31:17.116Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.093Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7a55fc66-0d5c-4ef6-af28-d4a4bb84381d",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Hydro",
                    "description": "Hydro Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16  Retrieved. 2019/10/16 ",
                    "url": "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/"
                },
                {
                    "source_name": "Kevin Beaumont",
                    "description": "Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ",
                    "url": "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.093Z",
            "description": "Some of Norsk Hydro's production systems were impacted by a [LockerGoga](https://attack.mitre.org/software/S0372) infection. This resulted in a loss of view which forced the company to switch to manual operations. (Citation: Kevin Beaumont) (Citation: Hydro)",
            "relationship_type": "uses",
            "source_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7ad4a725-8eb7-45b3-bfd7-f9bd29cc5970",
            "created": "2023-09-28T20:30:32.778Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.093Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7b1e00af-11fb-4862-a193-55dc9b6652c0",
            "created": "2023-09-29T16:33:23.456Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.094Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7b814e39-71fc-4e99-b46f-b24eca6cc780",
            "created": "2023-09-28T19:45:42.727Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7b8f6d2b-3091-4b0f-9987-88cd344007a1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--f4f3b9a6-2de0-45a5-8936-2ad9288191b9",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7b923320-8cb7-4d47-bedc-25a96560a7d0",
            "created": "2026-10-07T21:53:16.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:53:16.233Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7b95b2aa-9561-494f-8e02-d36edc14e38b",
            "created": "2023-09-29T17:39:54.089Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7bb1dbec-7314-479a-9496-86f8e25041eb",
            "created": "2023-09-29T16:40:43.415Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7bbe6ac7-d0fb-40e4-8537-bdded7173f07",
            "created": "2023-09-29T18:49:01.768Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7bd46875-7d59-4d65-8f9b-d48d3cb54a84",
            "created": "2023-09-28T20:07:15.553Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7be2d11d-87be-4d1c-8f5b-b7e59ad191ea",
            "created": "2023-09-28T20:07:01.309Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7bfaf0ff-6d88-460f-aa32-3fb0267b4f20",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:48.999Z",
            "description": "Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques likeDomain Fronting.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c1eee62-3307-4e25-8a20-919ccd56ec1c",
            "created": "2022-09-29T01:37:13.671Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                },
                {
                    "source_name": "Brubaker-Incontroller",
                    "description": "Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) has used the CODESYS protocol to download programs to Schneider PLCs.(Citation: Wylie-22)(Citation: Brubaker-Incontroller) [INCONTROLLER](https://attack.mitre.org/software/S1045) has also modified program logic on Omron PLCs using either the program download or backup transfer functions available through the HTTP server.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c35a530-27eb-42e7-9101-e6e6205df682",
            "created": "2026-10-07T21:16:28.884Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:16:28.884Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c3b65e8-e8b7-4c3b-b27b-e216986d8976",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) toggles breakers to the open state utilizing unauthorized command messages. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c433b29-0ad3-4574-990f-e3d6291e7f23",
            "created": "2023-09-29T18:48:29.126Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.095Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c7777a0-f96a-414c-b294-e9f0744bf8b8",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.096Z",
            "description": "In [Industroyer](https://attack.mitre.org/software/S0604) the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7c893581-c847-495a-aa93-9d98c516e1ae",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.096Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603)'s infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7ce83371-b84d-4a9e-b2d3-637dc7bf9844",
            "created": "2026-10-07T21:15:16.324Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:15:16.324Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7cfaea56-6125-4aad-a491-ce2f54a88c24",
            "created": "2026-04-22T20:42:02.295Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.096Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7d42ba22-9595-4463-8dda-c0e47a154fed",
            "created": "2023-09-28T20:07:48.301Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.097Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7d5759cd-890e-4ec5-b92b-aba225d52960",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.097Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7d752615-33f0-44ed-a156-25d84f384e75",
            "created": "2023-09-27T14:57:11.627Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:44.923Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), power company phone line operators were hit with a denial of service attack so that they couldn’t field customers’ calls about outages. Operators were also denied service to their downstream devices when their serial-to-ethernet converters had their firmware overwritten, which bricked the devices. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7db9687b-7099-4cb6-a040-bc32fc549a81",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.097Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7dd11d5e-1c1c-4f94-b4bf-4fd59988539b",
            "created": "2024-04-09T20:53:54.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.097Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7de5de32-6f37-4419-97b8-77eb9d69be40",
            "created": "2025-09-29T19:02:59.197Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.097Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7dedeb73-ef90-4282-a635-cc37326773af",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "University of Birmingham C2",
                    "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
                    "url": "https://arxiv.org/pdf/1408.1136"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.561Z",
            "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.(Citation: University of Birmingham C2)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7e0531c4-fb87-4d66-9595-024a08a71598",
            "created": "2026-04-20T20:54:20.734Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:20.734Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7ed1ad67-942a-424e-ad81-8b69a4f0c706",
            "created": "2023-09-28T20:28:16.122Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.099Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7efa1a31-da21-4925-aab0-96a012d5b2a7",
            "created": "2023-09-29T17:43:22.756Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.099Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7f3ee61b-3ef1-41da-9853-6520a2ea942d",
            "created": "2026-04-22T22:52:08.690Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.099Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7f4b7026-a747-49db-9b28-aff3de16afb2",
            "created": "2026-10-07T17:50:10.919Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:50:10.919Z",
            "description": "Harden browsers, HTML applications, and Windows scripting hosts that can execute JavaScript/JScript on ICS overlap assets.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7f520bef-d179-415a-b921-d30ff60d2284",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--636329e6-32b9-4a71-acf8-ae6d01a6b4ef",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7fdaa9be-aecf-459f-b028-7c35dc8b6451",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.100Z",
            "description": "Limit privileges of user accounts and groups so that only designated administrators or engineers can interact with alarm management and alarm configuration thresholds.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7ff12adb-bc9a-42e5-9cbf-613b200c36dc",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dan Goodin March 2017",
                    "description": "Dan Goodin 2017, March Virtual machine escape fetches $105,000 at Pwn2Own hacking contest Retrieved. 2020/09/25 ",
                    "url": "https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.100Z",
            "description": "Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Dan Goodin March 2017)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--80250a66-dec0-4ef5-8a76-b3aa24fe5bc3",
            "created": "2025-09-29T19:15:36.610Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.101Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--808174b7-3ab0-45b5-963e-5c10dd749e3c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.101Z",
            "description": "Statically defined ARP entries can prevent manipulation and sniffing of switched network traffic, as some AiTM techniques depend on sending spoofed ARP messages to manipulate network host's dynamic ARP tables.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--808c57e7-72ef-4860-b9ea-8ea072e2385a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.101Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--80a69b56-337d-446a-8167-8b9f63083c4f",
            "created": "2022-09-28T21:24:21.810Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.101Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) includes a library that creates Modbus connections with a device to request its device ID.(Citation: CISA-AA22-103A)(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--80cf98bd-b7dc-45cf-91a6-4ab6b79a7f0b",
            "created": "2024-03-25T20:17:49.585Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.101Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--80d77b53-6aa4-4703-946f-6c7f0748f823",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.102Z",
            "description": "Perform integrity checks of firmware before uploading it on a device. Utilize cryptographic hashes to verify the firmware has not been tampered with by comparing it to a trusted hash of the firmware. This could be from trusted data sources (e.g., vendor site) or through a third-party verification service.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81029694-8a6d-49f5-a053-ee2e29c086c7",
            "created": "2026-04-22T22:30:19.729Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.102Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81055366-e78b-40e0-a799-4b536ba03db3",
            "created": "2023-09-29T18:45:22.474Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.102Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81722115-69d3-4769-89e5-53491504d9c4",
            "created": "2026-09-26T02:55:08.718Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T02:55:08.718Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81806f43-c9aa-486e-8032-4e4665ba0d39",
            "created": "2023-09-29T18:43:13.760Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.102Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--818ce9d0-8fc2-4a34-a062-f0e6995bdf32",
            "created": "2023-09-28T21:13:00.330Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.103Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81ca994a-b350-424d-8f39-a0b64aa76260",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.103Z",
            "description": "Users can be trained to identify social engineering techniques and spearphishing emails.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81cd1138-ca48-4c06-8964-3fe007b3593a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.103Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--81fd1ae0-e3ef-40b7-86d8-89c85fd86100",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c0e6c96d-8605-407a-9bce-628e7853b07f",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--825cea69-6545-40c3-9a56-1ace30fc7dca",
            "created": "2026-09-25T19:17:57.024Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:17:57.024Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--4a2e4d0b-dd28-4b0d-8b83-8c9e66826c62",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--82810cd2-99e9-4ef6-b3fb-0a7a47d76661",
            "created": "2023-09-28T20:06:15.180Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.104Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--82b20c35-88c6-49aa-8241-a59512b17b74",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                },
                {
                    "source_name": "Langer Stuxnet",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved December 7, 2020.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.104Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) was able to self-replicate by being spread through removable drives. A willing insider or unknown third party, such as a contractor, may have brought the removable media into the target environment. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) The earliest version of Stuxnet relied on physical installation, infecting target systems when an infected configuration file carried by a USB stick was opened. (Citation: Langer Stuxnet)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--82c3a26d-0bb9-49f1-8586-e15ce5e67df7",
            "created": "2026-09-25T19:14:38.505Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:14:38.505Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell with the following command: `set @s = master..xp _ cmdshell extrac32 /y +@t+ +@t+x; exec(@s);` (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--834b1fa4-ee6d-43c7-9e07-1b6a47dee4a2",
            "created": "2026-04-22T20:38:34.433Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.105Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--83a964cb-730c-44e4-859b-b5246159396b",
            "created": "2023-09-29T17:59:43.275Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.105Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--83c29179-4805-403a-acf5-5151c4d2e556",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.105Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604)'s OPC and IEC 61850 protocol modules include the ability to send stVal requests to read the status of operational variables. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--83c8c216-7ff7-4bd3-9db4-573469628d95",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik August 2019",
                    "description": "Joe Slowik 2019, August 15 CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack Retrieved. 2019/10/22 ",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.105Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) SIPROTEC DoS module places the victim device into firmware update mode. This is a legitimate use case under normal circumstances, but in this case is used the adversary to prevent the SIPROTEC from performing its designed protective functions. As a result the normal safeguards are disabled, leaving an unprotected link in the electric transmission. (Citation: Joe Slowik August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--841ec349-0f4c-43fa-89b8-ef3656497fc9",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) contains an IEC 61850 module that enumerates all connected network adapters to determine their TCP/IP subnet masks. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--842a2b85-4e77-4eb6-99e1-c4a231aadf48",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "description": "Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8465924f-8201-43c4-bd7c-961215f839d0",
            "created": "2026-04-22T16:36:05.760Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84671396-a556-4a5d-9bb9-cac697277371",
            "created": "2023-09-29T16:31:12.255Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8474e6ef-39c4-4ecc-ba5a-cbd9b32b5c65",
            "created": "2023-09-28T21:11:15.610Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--847962a8-3dfd-4b8c-81a8-dc8284766109",
            "created": "2026-04-23T00:36:51.811Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.106Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84b0a0f5-79e6-4e18-a7fe-0a0427911416",
            "created": "2025-09-29T19:49:31.019Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84d9ff92-234f-4b11-a350-fad07941ff3e",
            "created": "2023-09-28T20:15:45.244Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84fa50ff-bb84-4ab6-b759-658c57532c42",
            "created": "2023-09-29T16:32:09.319Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84fd1e14-44a8-4eac-9bfc-67b50ea1acf7",
            "created": "2023-09-29T18:01:32.878Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8530c1ea-fe9f-4b04-be34-7404d5e30e75",
            "created": "2023-09-29T17:59:22.291Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--856cf76e-5058-41f0-ae71-6cb463fc36c7",
            "created": "2025-09-24T18:18:02.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.107Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--85b1bbb1-458f-4be3-8bd9-ef0fa23179ee",
            "created": "2025-09-29T18:57:01.145Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.108Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--85cd5c54-08b9-49e4-8a26-cc6c84704908",
            "created": "2026-09-25T19:16:38.404Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:16:38.404Z",
            "description": "During the [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilizes a Visual Basic script `lun.vbs` to execute `n.bat` which then executed the MicroSCADA `scilc.exe` command.(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "relationship_type": "uses",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--862d5dbb-4582-4a9b-877a-e323233b53fe",
            "created": "2026-10-08T21:52:39.633Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:04:44.482Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed passwords on internet-facing MicroLogix controllers, locking out operators, and causing water and wastewater utilities to lose control of their equipment (e.g., controllers, water towers, lift stations).(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86668811-c57b-4aba-860f-22ca4d7b9600",
            "created": "2025-09-29T19:05:59.118Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.109Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--868db512-b897-4a54-ae56-ac78f6c93a14",
            "created": "2022-09-28T20:29:18.027Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA22-103A",
                    "description": "DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.",
                    "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.296Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can use a Telnet session to load a malware implant on Omron PLCs.(Citation: CISA-AA22-103A)(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86a8d6aa-beff-4343-a0b2-dd099202b2dc",
            "created": "2023-09-28T19:58:13.866Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.109Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86d04319-a13e-4105-9def-c659360c4613",
            "created": "2026-04-22T20:28:54.853Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.109Z",
            "description": "Ensure proper network segmentation is followed to protect critical systems and devices.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86f1655a-db46-4d49-9051-6653da83eb13",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.109Z",
            "description": "Protect files with proper permissions to limit opportunities for adversaries to interact and collect information from databases. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86fef801-720c-4dcc-a970-211cb442a1fc",
            "created": "2026-10-07T20:37:33.243Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:37:33.243Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--86ff60b6-f5a1-4c18-a3ba-30843c73ba84",
            "created": "2026-10-07T20:20:10.677Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:20:10.677Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--872791ff-b341-4774-b275-d3c80c152746",
            "created": "2026-10-07T21:15:31.882Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:15:31.882Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--875296e5-6aba-4a44-a884-2419ea17b721",
            "created": "2026-10-07T20:18:24.428Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:18:24.428Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--876e4a50-7c73-4733-bad0-e3a701adf059",
            "created": "2025-09-29T21:58:16.538Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.110Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--87a546cf-387f-48c6-9b0f-1179af49be88",
            "created": "2026-04-22T22:48:12.355Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.110Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--87c8ab74-576d-4962-b641-0762d374d1e8",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.110Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. While the vulnerability does not directly cause the restart or shutdown of the device, the device must be restarted manually before it can resume operations. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--881abd90-78d3-4f25-ab87-e7e8b031c98d",
            "created": "2026-09-25T18:35:12.134Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos",
                    "description": "Dragos   Allanite Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/resource/allanite/"
                },
                {
                    "source_name": "Symantec March 2019",
                    "description": "Symantec 2019, March 27 Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S. Retrieved. 2019/12/02 ",
                    "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:35:12.134Z",
            "description": "[APT33](https://attack.mitre.org/groups/G0064) utilized PowerShell scripts to establish command and control and install files for execution. (Citation: Symantec March 2019) (Citation: Dragos)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88330b9a-d79c-4956-b1bb-81036164e2c0",
            "created": "2026-10-07T19:37:41.978Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:37:41.978Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88363abe-64e6-4a4a-9d6e-e9a886f1d372",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--825106d1-6f44-47a1-b8dd-c3e3b6cecab7",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88402181-99da-4c51-93d2-5203ee139da5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--fddbd892-faa2-40e1-b40d-2c6e33c00f14",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8869fa66-e54f-4c03-8290-a86a0cd0d8d6",
            "created": "2026-04-22T13:27:29.300Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.111Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88c470f0-7214-4a2b-bd35-3c71733ce392",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Research Whitepapers September 2018",
                    "description": "ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"
                },
                {
                    "source_name": "Intel",
                    "description": "Intel ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25  Intel Hardware-based Security Technologies for Intelligent Retail Devices Retrieved. 2020/09/25 ",
                    "url": "https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf"
                },
                {
                    "source_name": "N/A",
                    "description": "N/A   Trusted Platform Module (TPM) Summary Retrieved. 2020/09/25 ",
                    "url": "https://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.112Z",
            "description": "Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology.(Citation: N/A) Move system's root of trust to hardware to prevent tampering with the SPI flash memory.(Citation: ESET Research Whitepapers September 2018) Technologies such as Intel Boot Guard can assist with this.(Citation: Intel)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8ac1d6e1-b07f-476a-9732-84984ebc2405",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88cadeca-4012-4716-a095-9e1c79e59ec3",
            "created": "2023-09-29T16:47:08.696Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.112Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--88edcf36-a6f2-474f-b9c2-7800b34919a2",
            "created": "2023-09-28T21:24:07.864Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.112Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--890ddf20-18a6-4d23-98dd-970478133169",
            "created": "2026-04-22T22:35:51.042Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.112Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--89291706-4233-47c2-9b3e-b59bc01fcd80",
            "created": "2026-10-07T21:55:19.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:55:19.393Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--896e91ed-b145-43c2-a4c6-aa768fcb5293",
            "created": "2025-09-29T19:49:53.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.600Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--897cfc36-4253-4e1e-8825-726dbe9088a2",
            "created": "2023-09-28T19:55:02.944Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.113Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--898a9eb9-671e-4096-8288-72ffb49e93f3",
            "created": "2023-03-30T19:25:53.572Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 Mandiant April 2022",
                    "description": "Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.",
                    "url": "https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"
                },
                {
                    "source_name": "Industroyer2 Forescout July 2022",
                    "description": "Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.",
                    "url": "https://www.forescout.com/resources/industroyer2-and-incontroller-report/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.113Z",
            "description": "[Industroyer2](https://attack.mitre.org/software/S1072) is capable of sending command messages from the compromised device to target remote stations to open data channels, retrieve the location and values of Information Object Addresses (IOAs), and modify the IO state values through Select Before Operate I/O, Select/Execute, and Invert Default State operations.(Citation: Industroyer2 Mandiant April 2022)(Citation: Industroyer2 Forescout July 2022)",
            "relationship_type": "uses",
            "source_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--89923285-812d-4a09-8536-bf41943e8229",
            "created": "2026-09-26T05:29:35.355Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:29:35.355Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) degraded operations across at least seven states that resulted in reported incidents, pressure loss and flooding.(Citation: Tenable Minnesota Water Utilities)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd",
            "created": "2021-10-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.113Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) infects DLL's associated with the WinCC Simatic manager which are responsible for opening project files. If a user opens an uninfected project file using a compromised manager, the file will be infected with Stuxnet code. If an infected project is opened with the Simatic manager, the modified data file will trigger a search for the `xyz.dll` file. If the `xyz.dll` file is not found in any of the specified locations, the malicious DLL will be loaded and executed by the manager. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a3a5d90-a030-479e-b38d-d7d749f327d1",
            "created": "2025-09-29T19:08:00.768Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.114Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a765743-9caf-4c8a-9c58-6fe2c1993108",
            "created": "2023-09-29T16:42:43.736Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.114Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a7c4419-b2c6-4774-bcba-a28fc6c5bcce",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--74b96bd4-dab9-494e-a540-b7c998581fd5",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a80c4f3-8f5b-4b22-b2e8-ad472d4df89d",
            "created": "2026-04-23T00:37:26.011Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.114Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a86ad59-dff1-46dc-8ffd-3c62b96c6e62",
            "created": "2023-09-27T14:50:09.612Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.313Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) moved their tools laterally within the ICS network. (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a9fde66-7874-4418-8652-d8a987c0b5df",
            "created": "2025-09-29T22:05:35.591Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.114Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8ab684f0-96e1-4a4f-b139-44afd8d093f2",
            "created": "2025-09-29T19:08:29.213Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.114Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8af19674-6836-4d21-abfc-593252b282cb",
            "created": "2026-09-25T18:36:42.795Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TEMP.Veles 2018",
                    "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
                    "url": "https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:36:42.795Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) used a publicly available PowerShell-based tool, WMImplant.(Citation: FireEye TEMP.Veles 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b17ad46-b0cc-4766-9cae-eba32260d468",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.115Z",
            "description": "Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage  (Citation: National Institute of Standards and Technology April 2013). Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b2d82aa-75fc-4d6d-bb4b-9f600bd211fd",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "MDudek-ICS",
                    "description": "MDudek-ICS   TRISIS-TRITON-HATMAN Retrieved. 2019/11/03 ",
                    "url": "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.612Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) uses TriStations default UDP port, 1502, to communicate with devices.(Citation: MDudek-ICS)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b303086-8ae7-415b-b46d-16ce814aa94f",
            "created": "2026-04-22T16:35:32.349Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.115Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b3f5b8c-789e-4f61-8e5c-fb28f8662d32",
            "created": "2025-09-24T18:18:43.657Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.115Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b698bb5-5b69-4137-a3d4-f3acf251f87b",
            "created": "2026-04-22T16:39:55.588Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.115Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8b7403f5-90d2-4d2c-a484-87d29f419a9f",
            "created": "2023-09-27T14:49:29.987Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.002Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) scheduled the uninterruptable power supplies (UPS) to shutdown data and telephone servers via the UPS management interface. (Citation: Ukraine15 - EISAC - 201603)(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8c03fd0a-646f-4d79-83fc-8ec428191810",
            "created": "2026-04-20T20:54:24.019Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:24.019Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8c523980-7db0-4173-9df4-eba2c36f6655",
            "created": "2025-09-29T21:59:04.286Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.117Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8c5e273e-eec7-4ac8-881c-1c46717cf924",
            "created": "2026-10-07T20:31:17.072Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:31:17.072Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8c6fe57d-3344-4fe7-b547-a3c5046960bb",
            "created": "2025-09-24T18:12:11.580Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.117Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8ca2fe75-9bb3-4af5-8fee-accd33d6d2ec",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.117Z",
            "description": "Ensure remote commands that enable device shutdown are disabled if they are not necessary. Examples include DNP3's 0x0D function code or unnecessary device management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8ccd5f5c-420a-413b-81ef-5e40f401be95",
            "created": "2023-09-28T20:31:46.082Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.117Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d0793f1-e818-4632-8fb6-8c4aa5c7f073",
            "created": "2024-11-20T23:26:28.979Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.560Z",
            "description": "During [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041), the adversary initiated a firmware downgrade on impacted devices.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d0d6365-7bc0-417d-9268-c7c31fcb0d91",
            "created": "2023-09-27T14:49:48.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.018Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilized HMI GUIs in the SCADA environment to open breakers. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d392c6e-1368-4c6f-a189-aaf4c6355e55",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--09754c36-7be2-4536-aad2-a6c3568ba0e5",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d39646f-b224-4209-8c05-15002ea797b9",
            "created": "2026-04-23T00:29:36.779Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.118Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d4d0ce4-ca42-4a05-a959-89d6af2650e2",
            "created": "2026-04-22T20:26:41.624Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.118Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d7e2aa5-129a-4060-88ae-9fc066af13c7",
            "created": "2023-09-28T21:25:20.417Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.118Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8df1ff58-58d7-454e-a43d-d1e5244fd0fd",
            "created": "2026-10-07T21:20:57.382Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:20:57.382Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8e11c3ef-4ee3-4a91-868f-d0a1c10d538b",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--2145faf1-28da-4ebc-9730-f2e2a8764ced",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8e29dea4-1176-4fd8-8c73-6f5bccc7ec5e",
            "created": "2026-09-25T18:41:44.451Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:41:44.451Z",
            "description": "Where PowerShell is not required for the documented function of an ICS asset, disable or remove access to it. Do not apply this control to systems where vendor support, engineering workflows, backup, patching, or approved automation depend on PowerShell. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8ecf5eac-7767-411b-b54a-b374ea51b9e9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.120Z",
            "description": "Hot-standbys in diverse locations can ensure continued operations if the primarily system are compromised or unavailable. At the network layer, protocols such as the Parallel Redundancy Protocol can be used to simultaneously use redundant and diverse communication over a local network. (Citation: M. Rentschler and H. Heine)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8ed7e323-578c-4a62-bf32-0bf2fefa872b",
            "created": "2023-09-29T17:05:44.653Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.120Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8f76d408-be8a-478e-8a5a-aab1d1f96572",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Using OPC, a component of [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) gathers any details about connected devices and sends them back to the C2 for the attackers to analyze. (Citation: Daavid Hentunen, Antti Tikkanen June 2014)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8f7ccb2b-de2a-4a5c-9f1e-d5e58e69efa8",
            "created": "2023-03-30T19:00:57.773Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--337c4e2a-21a7-4d9a-bfee-9efd6cebf0e5",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8f7df0c0-9cc3-4322-847d-1f4ec35dfa65",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Filter for protocols and payloads associated with firmware activation or updating activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8f90363e-2825-4178-807f-9268a28760fa",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Enforce system policies or physical restrictions to limit hardware such as USB devices on critical assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9e3adcad-0b8f-4ecc-a2f3-06f607f53bf0",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8fa6fe89-e704-4be4-a15b-50e188084aa3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dan Goodin March 2017",
                    "description": "Dan Goodin 2017, March Virtual machine escape fetches $105,000 at Pwn2Own hacking contest Retrieved. 2020/09/25 ",
                    "url": "https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Dan Goodin March 2017)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8fcecf74-36df-41ab-9476-539c9ac0b339",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8fe2bc4c-e9f7-430d-84d5-e3d603141dcb",
            "created": "2023-09-29T17:04:17.682Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.121Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9042b73d-5c10-4797-bace-71e49adeebdf",
            "created": "2025-09-24T17:55:03.798Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.122Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9058043b-50b6-48de-b34b-5fb254fe471b",
            "created": "2026-09-26T05:11:40.254Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:11:40.254Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) manipulated critical shutdown and alarm logic, which would allow the system to enter unsafe process states without proper notification or protections.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--90647f03-38a4-4364-a3af-53640a81360e",
            "created": "2023-03-31T18:11:19.943Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik August 2019",
                    "description": "Joe Slowik 2019, August 15 CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack Retrieved. 2019/10/22 ",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:26.009Z",
            "description": "(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Joe Slowik August 2019)",
            "relationship_type": "attributed-to",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--90d4ef3f-f0d4-40ac-9f63-61242b757a32",
            "created": "2026-04-22T16:39:16.222Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.122Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--90d9c8e3-0250-4096-8d98-7ca1d324d654",
            "created": "2021-04-12T10:12:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                },
                {
                    "source_name": "ICS-CERT August 2018",
                    "description": "ICS-CERT 2018, August 22 Advisory (ICSA-14-178-01) Retrieved. 2019/04/01 ",
                    "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.123Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) payload has the capability of enumerating OPC tags, in addition to more generic OPC server information. The server data and tag names can provide information about the names and function of control devices. (Citation: ICS-CERT August 2018) (Citation: Daavid Hentunen, Antti Tikkanen June 2014)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--90de74d1-598a-4372-9d7a-ed2c872b4c42",
            "created": "2026-10-07T22:11:47.527Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T22:11:47.527Z",
            "description": "Apply exploit-protection controls to Python-capable Windows/Linux ICS overlap assets where supported, particularly when Python is embedded in engineering or vendor applications.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--90e245ae-a785-4956-be9b-dc4da0b290c5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--89e95503-b02c-43da-90b3-15584b27e6d6",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--910bada1-c923-4009-a9ea-da257072f168",
            "created": "2023-09-29T16:29:27.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.123Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9129c348-431e-45b4-8a7b-7bc71b47732b",
            "created": "2026-04-22T21:35:09.040Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.123Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--91501bcb-896f-4bda-9f97-196145646185",
            "created": "2026-04-23T00:30:00.479Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.123Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--917b1dc7-5fbd-47f4-addf-fa1dd869ccb5",
            "created": "2026-10-07T20:08:09.250Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:08:09.250Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--91f29477-2ff6-4dbf-bf68-c8825a938851",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.124Z",
            "description": "Update software regularly by employing patch management for internal enterprise endpoints and servers.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--928c6d15-e527-48a5-858a-ff04dc6ecf31",
            "created": "2026-10-07T21:40:50.271Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:40:50.271Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--92c8e2f2-0670-49a8-855c-4c5d1492fa36",
            "created": "2026-09-25T16:51:18.467Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T16:51:18.467Z",
            "description": "Consider the use of application isolation and sandboxing to restrict specific operating system interactions such as access through user accounts, services, system calls, registry, and network access. This may be even more useful in cases where the source of the executed script is unknown.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--92d1fd4f-6cc7-4db5-82f8-f8caa5ff59f0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.125Z",
            "description": "Protect files stored locally with proper permissions to limit opportunities for adversaries to remove indicators of their activity on the system. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9315cc99-8e64-4bdc-99b9-6c8ab9b1f5ce",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.125Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--931e05ae-0fc9-4e37-9c88-063b80fd1d61",
            "created": "2026-04-22T21:43:35.341Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.126Z",
            "description": "Ensure systems and devices have an alternative method for communicating in the event that communication channels become unavailable.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--93489277-7107-4bad-a9d1-2013ef471905",
            "created": "2026-04-23T14:06:34.173Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.126Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) has the ability to perform scans for TCP port 4840 to identify devices running OPC UA servers.(Citation: Wylie-22)",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--938ff1d4-acce-4e4e-8a9c-be62799dff8e",
            "created": "2023-09-29T17:38:40.536Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.126Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9397e373-3be0-4229-b390-fd5ed0482999",
            "created": "2025-09-24T18:13:57.178Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.126Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--93c336f2-7e7c-4c79-af16-faae03e66121",
            "created": "2023-09-29T18:44:09.293Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.126Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--93c52f94-839f-4093-b160-55af996c99c3",
            "created": "2026-10-07T21:52:50.978Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:52:50.978Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--943a9a5c-7826-451d-ac73-34353ea40595",
            "created": "2023-09-29T16:33:36.496Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.127Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--94654460-b115-4056-beb1-e982ed33437b",
            "created": "2023-03-30T18:59:46.674Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.127Z",
            "description": "Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from the local system. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9515f24c-1c33-4197-b9c9-b9992bc696ca",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.128Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) copies itself to various Program Organization Units (POU) on the target device.  The POUs include the Data Block, Function, and Function Block. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9537d9c9-ba0d-42d9-b97d-3b28bfe265e6",
            "created": "2024-04-09T20:47:47.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.128Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--954fc7ef-7e8a-446c-82d1-9798d8c00fbe",
            "created": "2026-04-22T20:00:48.737Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.828Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used valid accounts to access Hitatchi RTUs, Mikronika RTUs, Hitachi Relion Protection and Control Relays, Mikronika HMI Computers, and Moxa NPort Serial Device Servers.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--962128bd-13b9-48a6-a4c8-3f07104a962f",
            "created": "2026-04-22T16:07:15.471Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.130Z",
            "description": "Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--966b59c0-8641-432c-84f7-b2a712004d74",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.130Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) IEC 104 module has 3 modes available to perform its attack. These modes are range, shift, and sequence. The range mode operates in 2 stages. The first stage of range mode gathers Information Object Addresses (IOA) and sends select and execute packets to switch the state. The second stage of range mode has an infinite loop where it will switch the state of all of the previously discovered IOAs. Shift mode is similar to range mode, but instead of staying within the same range, it will add a shift value to the default range values. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--968830b7-ee80-4a6e-96a4-9fc70470e4a9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.130Z",
            "description": "Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and public disclosure.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--968fd463-fec4-4b2d-b3c9-950d8471b9a8",
            "created": "2023-09-28T20:25:30.229Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.130Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9700cbbe-4107-4c4f-b6df-32b9048e370a",
            "created": "2026-04-20T20:54:21.238Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:21.238Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--973f5884-a076-413e-ac96-f0bd01375fb6",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.131Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs installed on safety or control assets, including the associated controller tasking.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--97756c8a-b702-472b-8d67-15464a73093e",
            "created": "2023-09-27T14:56:28.962Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.032Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [KillDisk](https://attack.mitre.org/software/S0607) rendered devices that were necessary for remote recovery unusable, including at least one RTU. Additionally, [Sandworm Team](https://attack.mitre.org/groups/G0034) overwrote the firmware for serial-to-ethernet converters, denying operators control of the downstream devices. (Citation: Booz Allen Hamilton)(Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--97c5b388-518a-46ec-b2b0-41bfa6a83204",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.132Z",
            "description": "Update software regularly by employing patch management for internal enterprise endpoints and servers.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--97e20860-29d9-4738-a9a8-6cc3e4db23f1",
            "created": "2023-09-29T16:40:54.250Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.132Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--97f42cef-bc2a-47c5-b408-8e38aab4030e",
            "created": "2023-09-29T16:41:32.631Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.132Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98288d43-50ca-4720-a5e4-f76f07e9f7cd",
            "created": "2026-04-22T22:49:14.057Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.132Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--982d0b4f-274a-4738-9262-57fc80d468f9",
            "created": "2024-03-26T15:41:51.806Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.132Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--983de217-1ea6-483a-a273-ecf950706cd7",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--519082ce-24ab-4f6b-9e86-b9443758c9d4",
            "target_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--984992e3-0407-406a-b8dd-c114d8b2d9a2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.133Z",
            "description": "Devices should authenticate all messages between master and outstation assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--984d517f-56a1-4eb4-95e5-994eb9c6c3b5",
            "created": "2024-03-27T20:46:21.569Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:11:05.557Z",
            "description": "During the [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034), [Sandworm Team](https://attack.mitre.org/groups/G0034) executed a MicroSCADA application binary `scilc.exe` to send a predefined list of SCADA instructions specified in a file defined by the adversary, `s1.txt`. The executed command `C:\\sc\\prog\\exec\\scilc.exe -do pack\\scil\\s1.txt` leverages the SCADA software to send unauthorized command messages to remote substations.(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "relationship_type": "uses",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98567b03-7421-4761-8caa-cbea82d89fe3",
            "created": "2024-03-26T15:40:06.457Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.133Z",
            "description": "Configure operating systems to disable the autorun of any specific file types or drives.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9a945a29-5233-4422-a9e3-3e957b0e8bce",
            "target_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9897bb19-d5bb-4c43-9415-983ba5c5bbe5",
            "created": "2025-09-29T19:52:11.047Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.133Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98d7d238-3473-4e3c-adc0-3c8d33341466",
            "created": "2026-04-23T00:26:22.850Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "description": "ll field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98e109ce-29d8-4711-91c1-a6322b20bd3a",
            "created": "2026-04-22T20:16:47.589Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98f1d575-a975-42ae-8b00-2c9e22d560d5",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "description": "Set and enforce secure password policies for accounts.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--98f91f4f-050b-43b7-a033-589ec507913f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--442bf059-f7cf-460b-8200-f35e1e0a0c78",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9902691c-aaf2-48a1-b1ca-cd6f652ae1c6",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) is able to block serial COM channels temporarily causing a denial of control. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--990f944f-190d-456d-b194-f5ecb17a0868",
            "created": "2019-06-24T17:20:24.258Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Catalin Cimpanu April 2016",
                    "description": "Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 ",
                    "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "description": "A [Conficker](https://attack.mitre.org/software/S0608) infection at a nuclear power plant forced the facility to temporarily shutdown. (Citation: Catalin Cimpanu April 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9951eb11-8140-420d-8e2d-56fbe0ff0134",
            "created": "2023-09-29T18:03:23.576Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.134Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--99d2eeab-8ace-41c9-b47d-4058dd906136",
            "created": "2023-09-28T20:10:55.590Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.135Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--99ec0a8e-4a4f-427c-89db-163e4b206021",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.135Z",
            "description": "Hot-standbys in diverse locations can ensure continued operations if the primarily system are compromised or unavailable. At the network layer, protocols such as the Parallel Redundancy Protocol can be used to simultaneously use redundant and diverse communication over a local network. (Citation: M. Rentschler and H. Heine)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--99f84b91-32a1-4ade-8de5-5d2a0359302f",
            "created": "2023-09-28T19:56:54.642Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.135Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9a2291c2-9515-4343-ad47-380b5c6db29f",
            "created": "2026-10-07T20:19:02.720Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:19:02.720Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9a44b2a8-9f4c-43df-9174-1cba6e165886",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.135Z",
            "description": "Allow/denylists can be used to block access when excessive I/O connections are detected from a system or device during a specified time period.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9a55e351-d3b7-460a-9a9d-6714c00db5f0",
            "created": "2024-03-25T19:59:09.628Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:43.028Z",
            "description": "(Citation: CISA AA23-335A IRGC-Affiliated December 2023)",
            "relationship_type": "attributed-to",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9a607f89-85b8-4fba-8eb7-7e4900ea693f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.572Z",
            "description": "Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9aacca46-bf65-4247-b14c-65359d1b47db",
            "created": "2026-04-23T00:40:25.161Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.136Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9abf0914-2508-4717-9f1a-8f209c2d20a3",
            "created": "2025-09-24T17:55:33.001Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.136Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9b0b3c25-d87c-452a-a2f9-241234410eb8",
            "created": "2023-09-29T18:58:05.958Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.136Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9b412b1f-2dd0-4e7f-8364-f625181ba1db",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.137Z",
            "description": "Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining access to valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ddf3e568-f065-49e2-9106-42029a28ddbd",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9b7bc0f3-c7cf-47e4-a3ed-0f91e01831ca",
            "created": "2026-04-23T00:06:49.258Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.137Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9b802cf9-03e4-414f-af09-fc108e96839c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.137Z",
            "description": "Devices should verify that firmware has been properly signed by the vendor before allowing installation.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9b825e77-2b18-4bc8-8e1d-5f645d570dca",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Xenotime 2018",
                    "description": "Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.",
                    "url": "https://dragos.com/resource/xenotime/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:42.187Z",
            "description": "(Citation: Dragos Xenotime 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
            "target_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9ba6c904-d1bd-46dd-95fb-6da58333fa40",
            "created": "2026-04-22T13:57:38.576Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.137Z",
            "description": "Devices should authenticate all messages between master and outstation assets.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9bb98efc-3712-4df3-a1a4-8dfefd2983fa",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--58b4bda4-d69a-4a20-ab67-308c4451a5e8",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9c23121e-14bb-4382-b54d-2ea02a2815b5",
            "created": "2023-09-28T19:59:44.009Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.138Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9ca97ea4-faf6-484c-bccf-311c282bed02",
            "created": "2025-09-29T21:57:09.083Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9cca3120-c95e-4f5e-bc4b-0521ab5cc512",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9ce25235-ad56-4158-a392-31ef70b10c2a",
            "created": "2025-09-29T19:52:49.261Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9cfee66a-96e2-4dd9-b046-19f3562b3112",
            "created": "2023-09-28T21:17:32.313Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9d10209f-077c-4d25-87e9-c1ea423a528f",
            "created": "2026-04-22T20:19:16.164Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9d463aef-aa70-4375-9ed3-4b0387ba70e6",
            "created": "2026-04-23T00:38:38.695Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.139Z",
            "description": "ll field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9d69d936-58a0-4453-8424-40fcc7bc2e1c",
            "created": "2023-09-29T17:05:20.132Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.140Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9d6f9bba-dd79-4cb6-a0f3-1284e58a6236",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.140Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604)'s data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9db1ecfe-72eb-42da-a09e-746663a53854",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "MDudek-ICS",
                    "description": "MDudek-ICS   TRISIS-TRITON-HATMAN Retrieved. 2019/11/03 ",
                    "url": "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.140Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) contains a file named TS_cnames.py which contains default definitions for program state (TS_progstate). Program state is referenced in TsHi.py.(Citation: MDudek-ICS)\n\n[Triton](https://attack.mitre.org/software/S1009) contains a file named TS_cnames.py which contains default definitions for key state (TS_keystate). Key state is referenced in TsHi.py.(Citation: MDudek-ICS)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9e44709f-7068-4a2e-935b-44b309b76acd",
            "created": "2023-09-28T21:11:29.314Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.141Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9e98d88c-4138-4d0e-8db0-cddf956ab500",
            "created": "2023-09-29T18:07:28.902Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.141Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f07c92a-78a0-438a-8cb2-01e2bddaeb42",
            "created": "2021-01-04T21:30:14.830Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Industroyer",
                    "description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2017",
                    "description": "Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.",
                    "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
                },
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                },
                {
                    "source_name": "mandiant_apt44_unearthing_sandworm",
                    "description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
                },
                {
                    "source_name": "Secureworks IRON VIKING",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.138Z",
            "description": "(Citation: Dragos Crashoverride 2018)(Citation: Dragos Crashoverride 2017)(Citation: ESET Industroyer)(Citation: Secureworks IRON VIKING)(Citation: mandiant_apt44_unearthing_sandworm)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f2926a2-596f-459e-827e-6fe2d4646efd",
            "created": "2023-09-29T18:06:46.756Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.142Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f2f9cba-b7fc-45cb-8e66-e2f8f99ebe35",
            "created": "2025-09-29T19:01:58.777Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.142Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f43126d-5f6c-42a9-9908-49175c27ead7",
            "created": "2023-03-30T19:27:26.398Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Industroyer2 ESET April 2022",
                    "description": "ESET. (2022, April 12). Industroyer2: Industroyer reloaded. Retrieved March 30, 2023.",
                    "url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"
                },
                {
                    "source_name": "mandiant_apt44_unearthing_sandworm",
                    "description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.153Z",
            "description": "(Citation: Industroyer2 ESET April 2022)(Citation: mandiant_apt44_unearthing_sandworm)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--6a0d0ea9-b2c4-43fe-a552-ac41a3009dc5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f54f1ed-0390-4d21-9929-0bd57e821a68",
            "created": "2026-09-25T20:09:20.222Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:09:20.222Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9f5e8e35-663e-477b-86ab-75dfc9695ed8",
            "created": "2026-09-25T16:50:47.761Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T16:50:47.761Z",
            "description": "Consider removing or restricting features that are unnecessary to an asset's intended function within the control environment.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9fa6797f-f2cb-4b93-b8eb-f40936e967f3",
            "created": "2023-09-28T21:12:14.470Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.143Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9ffbf620-8e1f-4542-a271-9a3692db9a47",
            "created": "2023-09-28T20:04:19.147Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.143Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a0151b8f-30ee-49da-8365-17f34eab0825",
            "created": "2025-09-24T18:23:29.097Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.625Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a016cddb-5cd8-485b-a207-9860e9ec0a02",
            "created": "2026-04-23T00:02:30.922Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.143Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a04169ed-c16b-466b-80ef-22a11067f475",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.143Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) is able to block serial COM channels temporarily causing a denial of view. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a05f4a7a-eebb-463a-97e6-1088b94fa78b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.144Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a071df12-8c07-40ee-91be-c2cbba753e39",
            "created": "2026-10-07T19:38:07.364Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:38:07.364Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a07f265e-e04e-496c-b1bd-65f57b85a491",
            "created": "2023-09-29T16:40:30.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.144Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a08d85dd-a8b3-4848-94aa-941c43b6d8f2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.144Z",
            "description": "Prevent unauthorized systems from accessing control servers or field devices containing industrial information, especially services used for common automation protocols (e.g., DNP3, OPC).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a1383f2a-2ee2-47df-a661-8904a7535e0c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA June 2013",
                    "description": "CISA 2013, June Risks of Default Passwords on the Internet Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA13-175A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.144Z",
            "description": "Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. (Citation: CISA June 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a15d718f-af30-4745-a837-887ba8f48727",
            "created": "2023-09-29T16:30:46.705Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.145Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a1cbbdb5-30ad-4139-9784-e5a134f8d405",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Inc. June 2017",
                    "description": "Dragos Inc. 2017, June 13 Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations Retrieved. 2017/09/18 ",
                    "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.145Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) has a destructive wiper that overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files. (Citation: Dragos Inc. June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a1d2df14-6f44-44ac-99c2-3e3f55f53476",
            "created": "2023-09-29T16:43:16.472Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.145Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a1d99bbc-8d7c-4263-a909-95a9507b43c3",
            "created": "2023-09-29T16:28:17.629Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.013Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a1e6b6f0-b13c-48a0-b62d-12dfb80112ad",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.145Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a20bde51-3ed9-4306-92cd-f4f12d3aa8aa",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--f1a7e304-d05f-4e48-89b7-8b034f507c32",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a221bbb3-5f4f-4879-ae1d-37e8d3022039",
            "created": "2023-09-28T21:16:05.517Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.146Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a22fabd2-836e-4141-9219-c76cc10138ec",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.146Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a23297f1-58b9-48f4-8289-e81c34d9a522",
            "created": "2026-04-23T00:05:58.225Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.146Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a23aefa6-15f5-481c-ac3d-09b8e4b3003b",
            "created": "2023-09-29T16:44:03.912Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.146Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a287bc05-20cb-4476-ba1f-15bfde6e601d",
            "created": "2023-09-29T18:04:05.993Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.146Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a2f0b9ba-2d6e-43a5-adca-3ec42dba5ce9",
            "created": "2023-09-29T16:36:28.818Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.147Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a31d48c1-785e-4587-a102-d910054143fb",
            "created": "2025-09-24T18:22:30.026Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.147Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3447ec8-3224-4485-9324-cdc77231aaa5",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:56.361Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--930b268b-abf0-485f-9854-60c1cfdd2d33",
            "target_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a350a6c6-c95c-401e-9437-cb275776cc00",
            "created": "2026-10-07T21:45:25.687Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:45:25.687Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a36492bd-175a-4c39-9c56-32d06660dd05",
            "created": "2025-09-29T19:08:51.819Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.147Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3971be9-7bef-4663-b6c3-3cffc418f76b",
            "created": "2026-04-22T16:08:28.721Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3c8ede9-78d4-49c0-b1f2-16257c940189",
            "created": "2026-04-22T22:51:49.356Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3df8609-d9c4-4ef0-9a58-8d7155fba4f7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3f1ae82-b279-41ec-828e-40e969c7b165",
            "created": "2023-09-29T18:07:09.213Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3f258ea-6d4d-4b0e-8ff2-b91f49dfd4d7",
            "created": "2023-09-29T16:39:54.248Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.637Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3fb7c3c-7064-43d2-849c-2a5893583de9",
            "created": "2026-04-22T22:37:55.075Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "description": "Segment operational networks to isolate critical systems and devices that do not require broad network access.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a43e516e-603f-4863-a315-17c998b2f6f8",
            "created": "2026-04-22T13:29:01.989Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.148Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a466d5b4-39f0-48c1-9a19-f006dc4cb0ac",
            "created": "2023-09-29T17:40:58.726Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.149Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a48f58bc-4119-4399-b7d1-7e44b867399d",
            "created": "2026-04-22T16:38:52.943Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.149Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a4c64fbc-bac4-44b8-ba52-8fcfa3f674e5",
            "created": "2023-09-29T17:40:08.922Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.149Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a4c81fe6-1ad9-4bba-a415-a3c099eaa2be",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.149Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) stops the execution of the user program on the target to enable the transfer of its own code. The worm then copies itself to the target and subsequently starts the target PLC again. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a4da9bf3-d9da-4bc3-bb59-a5d17fa53b20",
            "created": "2026-04-22T20:46:51.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:55.198Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--56bf71a3-a28b-4a8f-84ed-3a71449d47c0",
            "target_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a4e9cd0c-75aa-47ec-9fdc-ad9dd8935af2",
            "created": "2025-09-29T19:07:27.830Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.149Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a57b233b-6613-4f78-aa48-e85518aaa7cf",
            "created": "2023-09-27T14:45:26.126Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Charles McLellan March 2016",
                    "description": "Charles McLellan. (2016, March 4). How hackers attacked Ukraine's power grid: Implications for Industrial IoT security. Retrieved September 27, 2023.",
                    "url": "https://www.zdnet.com/article/how-hackers-attacked-ukraines-power-grid-implications-for-industrial-iot-security/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.059Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) remotely discovered operational assets once on the OT network. (Citation: Charles McLellan March 2016) (Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a5b4b91c-0f68-4b88-bd6f-ab226ae9b5f0",
            "created": "2026-04-22T22:21:44.462Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "LockerGoga Revisited",
                    "description": "Joe Slowik. (2020, March 17). Spyware Stealer Locker Wiper: LockerGoga Revisited. Retrieved April 22, 2026.",
                    "url": "https://www.dragos.com/blog/industry-news/spyware-stealer-locker-wiper-lockergoga-revisited/"
                },
                {
                    "source_name": "Kevin Beaumont",
                    "description": "Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ",
                    "url": "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"
                },
                {
                    "source_name": "Detecting LockerGoga",
                    "description": "Oleg Kolesnikov and Harshvardhan Parashar. (2019, April 30). Detecting LockerGoga Targeted IT/OT Cyber Sabotage/Ransomware Attacks. Retrieved April 22, 2026.",
                    "url": "https://www.securonix.com/wp-content/uploads/2021/07/Securonix-Threat-Research-Report-Detecting-LockerGoga.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.151Z",
            "description": "[LockerGoga](https://attack.mitre.org/software/S0372) has disabled all the network interfaces on the system via netsh.exe to include Wi-Fi.(Citation: LockerGoga Revisited)(Citation: Kevin Beaumont)(Citation: Detecting LockerGoga)",
            "relationship_type": "uses",
            "source_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "target_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a5f6d393-5032-4ed1-ab78-04755582c1ff",
            "created": "2026-09-25T19:17:17.559Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:17:17.559Z",
            "description": "Restrict cmd.exe, batch files, and command-shell child processes to approved binaries, paths, parent processes, accounts, and maintenance workflows on Windows-based ICS assets. Preserve documented vendor and engineering dependencies. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a61e5450-cfb0-46b4-9726-0e28c4e97a6b",
            "created": "2026-09-26T05:31:50.224Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:31:50.224Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) locked out operators by changing the PLC’s IP address.(Citation: Tenable Minnesota Water Utilities)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a61fa979-f701-4dbe-b040-397b152ac14f",
            "created": "2026-04-23T00:37:53.519Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.151Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6277ff6-9cdf-484f-a902-3f9442039905",
            "created": "2024-09-11T22:55:18.833Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.151Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) shut down remote access services such as SSH, HTTP, telnet, and SNMP to a device along with deleting the routing table for routing devices to inhibit system accessibility and communication.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6479493-6154-408f-90df-9d2f3ae352d1",
            "created": "2023-03-31T17:46:01.470Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:26.096Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) used valid accounts to laterally move through VPN connections and dual-homed systems.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6519c11-e9d4-4b6f-8d92-8efaa2144c28",
            "created": "2021-04-13T12:28:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Davey Winder June 2020",
                    "description": "Davey Winder 2020, June 10 Honda Hacked: Japanese Car Giant Confirms Cyber Attack On Global Operations Retrieved. 2021/04/12 ",
                    "url": "https://www.forbes.com/sites/daveywinder/2020/06/10/honda-hacked-japanese-car-giant-confirms-cyber-attack-on-global-operations-snake-ransomware/?sh=2725c35753ad"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.152Z",
            "description": "[EKANS](https://attack.mitre.org/software/S0605) infection resulted in a temporary production loss within a Honda manufacturing plant. (Citation: Davey Winder June 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6bdcd4d-f3e8-42bb-b74e-993cb04de17e",
            "created": "2026-10-07T20:29:20.640Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:29:20.640Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6d8b66d-fc10-404f-b0ae-e8c66506b818",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.152Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604)'s data wiper component removes the registry image path throughout the system and overwrites all files, rendering the system unusable. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6e404c9-7b12-4403-8f2a-2815b8b87372",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--441ded70-7e25-47f1-b55c-0fafb7d4f44c",
            "target_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6e9bbe1-3e59-45c0-987a-b5354d602dc7",
            "created": "2023-09-29T17:05:56.185Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.152Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a6ebd61b-7845-4694-9860-2e8998f2841f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.152Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a717ccc7-0fe6-4a83-951f-5a89037ed927",
            "created": "2023-03-30T14:08:06.442Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a72c212f-6d4f-4c5d-873d-afa42021024c",
            "created": "2024-03-26T15:42:10.203Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7333752-af0d-42e0-88e5-7c1134e6e6c8",
            "created": "2026-04-20T20:54:25.517Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:25.517Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7649bd4-5b10-4d55-adaf-228e31472dff",
            "created": "2023-09-28T21:23:01.421Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a78e727c-8e42-448c-beb4-463804e18be0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "description": "Minimize permissions and access for service accounts to limit impact of exploitation. (Citation: Keith Stouffer May 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a78fc081-051a-45ca-91c2-c3f29325cbf2",
            "created": "2026-04-22T13:53:34.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7a2790e-d5ba-4a46-bde3-c698c6ae52ac",
            "created": "2023-09-28T19:41:16.927Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.153Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7caa7f2-cfb9-4fc9-ae8d-49349b6c260f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "description": "All field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7fbe555-a61b-4b93-bfb2-8e0dd0d6323e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "description": "Consider utilizing jump boxes for external remote access. Additionally, dynamic account management may be used to easily remove accounts when not in use.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a846dbe5-9ef3-4fb6-93d5-f764671a75c8",
            "created": "2021-04-11T14:06:54.109Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ICS CERT September 2018",
                    "description": "ICS CERT 2018, September 06 Advantech/Broadwin WebAccess RPC Vulnerability (Update B) Retrieved. 2019/12/05 ",
                    "url": "https://www.us-cert.gov/ics/advisories/ICSA-11-094-02B"
                },
                {
                    "source_name": "ICS-CERT December 2014",
                    "description": "ICS-CERT 2014, December 10 ICS Alert (ICS-ALERT-14-281-01E) Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) Retrieved. 2019/10/11 ",
                    "url": "https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.174Z",
            "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet. (Citation: ICS-CERT December 2014) (Citation: ICS CERT September 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a847aa03-ea56-47d1-8f4e-f9e0dd9707a0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "description": "Consider removal of remote services which are not regularly in use, or only enabling them when required (e.g., vendor remote access). Ensure all external remote access point (e.g., jump boxes, VPN concentrator) are configured with least functionality, especially the removal of unnecessary services. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a849d434-a070-43ff-a73f-49ff616ad865",
            "created": "2026-04-22T22:34:32.303Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a84dd2f5-d4f4-44c1-ba51-4804f40576e1",
            "created": "2023-09-28T20:28:27.970Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a8563939-14f9-4790-a8bb-6e984e3ad7ac",
            "created": "2026-04-23T00:07:07.724Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a86cee0a-dc49-4c95-b5dc-37405337490b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.154Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a873cbaa-04c1-4402-a8d1-683cc7b1ac85",
            "created": "2025-09-29T19:45:58.559Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.155Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a8f136ed-4ab7-4dbc-ba22-db57ace5ed6e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.155Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a90c8f61-75af-4da2-8813-ad60c5493283",
            "created": "2026-10-07T21:45:50.020Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:45:50.020Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a91002fe-21b2-4417-9c23-af712a7a035c",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.155Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs installed on safety or control assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a91295dc-b381-4dc9-9384-9f9949066778",
            "created": "2023-09-29T18:42:18.446Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.155Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a918d944-e50b-4b2c-9b77-6e28afe68607",
            "created": "2025-09-29T21:58:43.655Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.155Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a93ba793-24dd-47dd-b32c-4c3016124c90",
            "created": "2023-09-29T18:43:02.969Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.026Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a946c9b1-5b89-44c9-b617-3412ffda34b9",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "MDudek-ICS",
                    "description": "MDudek-ICS   TRISIS-TRITON-HATMAN Retrieved. 2019/11/03 ",
                    "url": "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.156Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) calls the SafeAppendProgramMod to transfer its payloads to the Tricon. Part of this call includes preforming a program upload. (Citation: MDudek-ICS)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a97c2f8c-c7c9-423f-8679-a58c11f8d409",
            "created": "2026-04-22T22:37:05.299Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.156Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a99cb0b8-4ac0-4712-850a-3aac16f87520",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.156Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a9dd70c2-2f54-4b19-85df-df11cbeb0dbd",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--b25c4621-5d38-43ee-871e-0e5c02f2f48c",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aa444531-fa05-4bb4-a23e-8ac133781131",
            "created": "2026-04-22T17:27:46.121Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.157Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) copies itself into Step 7 projects in such a way that it automatically executes when the Step 7 project is loaded. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aa7a0f45-e027-4d79-8413-5d807f44c1ba",
            "created": "2023-09-29T17:42:56.284Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.157Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aabf71ab-4121-4e3e-888d-cc16d2133846",
            "created": "2024-03-25T20:05:52.868Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
                    "description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
                },
                {
                    "source_name": "CISA Unitronics November 2023",
                    "description": "DHS/CISA. (2023, November 28). Exploitation of Unitronics PLCs used in Water and Wastewater Systems. Retrieved March 25, 2024.",
                    "url": "https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.861Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) discovered and exploited default credentials found on many Unitronics [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). For many of these devices, the default password was set to ‘1111’.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: CISA Unitronics November 2023)",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab306654-2abb-4983-8d30-df4058adb06c",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Selena Larson, Camille Singleton December 2020",
                    "description": "Selena Larson, Camille Singleton 2020, December RANSOMWARE IN ICS ENVIRONMENTS Retrieved. 2021/04/12 ",
                    "url": "https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:33:45.869Z",
            "description": "The [REvil](https://attack.mitre.org/software/S0496) malware gained access to an organizations network and encrypted sensitive files used by OT equipment. (Citation: Selena Larson, Camille Singleton December 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab60fe4a-5860-410a-8bca-2cdbea95e5f8",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.158Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab844cd2-0f56-44f9-9838-cd5f04d75f3e",
            "created": "2023-09-29T17:37:16.719Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.158Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab85bff5-7f2a-400c-a86e-b63747200e1f",
            "created": "2026-09-26T05:12:23.178Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:12:23.178Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) manipulated process logic, HMI, and SCADA displays. In addition to this, adversaries locked victims out by changing the PLCs management passwords.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab8bf0a3-0eef-4364-a3f9-f6ab6222afed",
            "created": "2023-09-28T19:41:30.623Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.158Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ab8e129c-5411-4784-9194-068fa915da23",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov",
                    "description": "Anton Cherepanov   BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry Retrieved. 2019/10/29 ",
                    "url": "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.158Z",
            "description": "[KillDisk](https://attack.mitre.org/software/S0607) deletes application, security, setup, and system event logs from Windows systems. (Citation: Anton Cherepanov)",
            "relationship_type": "uses",
            "source_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "target_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--abce8e63-b622-441b-9b79-1fdd95da8cff",
            "created": "2026-09-26T05:07:29.132Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:07:29.132Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used the manufacturers’ commercial PLC programming and maintenance software to send unauthorized command messages to multiple victim controllers. These include Rockwell Automation’s [Studio Logix 5000 Designer](https://attack.mitre.org/software/S9054), Schneider Electric’s [EcoStruxure Control Expert](https://attack.mitre.org/software/S9056), and Siemens’ [Totally Integrated Automation (TIA) Portal](https://attack.mitre.org/software/S9055) .(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ac1e880f-cc28-4344-91f3-6decd83975c4",
            "created": "2026-10-01T14:32:34.330Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "AI-Mexico-Govt-Breach",
                    "description": "Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.",
                    "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-01T14:32:34.330Z",
            "description": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with generating and executing numerous Python scripts including [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) to achieve their objectives.(Citation: AI-Mexico-Govt-Breach)",
            "relationship_type": "uses",
            "source_ref": "campaign--199f5568-ca25-4892-b7a5-870503e4d0f4",
            "target_ref": "malware--ab183324-4634-45bc-98af-9458bb94bcef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ac63d227-ff8a-43b8-81ef-ec4c046c4291",
            "created": "2023-10-02T20:20:19.426Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.160Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ac7a74a9-7e1d-49d2-b1d8-0f0712fd578f",
            "created": "2023-09-28T20:31:31.498Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.160Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ac8d2d28-5fdc-44d6-9e5a-8e5560b3f91f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.160Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--acb4e9f0-0c1a-4c34-a88c-9125f0bd453a",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.042Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--887ae691-a519-4b68-af26-bcea1483cef7",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--acc06595-994a-469b-972e-c71ab3298dde",
            "created": "2026-09-26T05:08:44.138Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:08:44.138Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used the program upload feature to exfiltrate project files from victim PLCs. (Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--acc646be-70db-48c0-9504-25ad122ddb40",
            "created": "2026-04-22T22:33:32.825Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.160Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--acd320fb-8c30-48d4-8ca0-c5379e0998fc",
            "created": "2025-09-29T19:15:47.679Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.160Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ad2ed5dc-d683-4b0e-b1e2-50b2e61ffd11",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--d9469edc-7e55-41bc-8b17-a8db9fc6302e",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ad3774f0-d286-4315-95db-a3a78752ef3b",
            "created": "2026-04-22T22:36:26.116Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.161Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ad7770c3-fe24-4285-9ce2-1616a1061472",
            "created": "2019-04-17T14:45:59.681Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye FIN6 Apr 2019",
                    "description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:31.008Z",
            "description": "(Citation: FireEye FIN6 Apr 2019)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
            "target_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ad7fd147-066e-4ed5-aa9d-7b2f1771150d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.161Z",
            "description": "Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application. (Citation: Karen Scarfone; Paul Hoffman September 2009)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ad8ca360-621d-4286-b092-695c18df73df",
            "created": "2026-10-07T19:38:48.787Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:38:48.787Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--adb41ca8-7d2a-4025-b673-db44c9e1f16b",
            "created": "2023-09-28T21:12:39.257Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.161Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--adc6a1fa-c265-481f-8cde-f28a30873682",
            "created": "2025-09-24T18:19:51.177Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.161Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ade12d27-13bb-4ebf-be08-7039cf699682",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--adf2072c-0341-4fc2-9d25-495b4af864e9",
            "created": "2023-03-10T20:09:22.370Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.217Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary temporarily shut an investigator out of the network preventing them from issuing any controls.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--adf230b9-b622-473e-b7f4-6ea2dd13ab43",
            "created": "2026-04-23T00:22:56.882Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.241Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) downloaded multiple rounds of control logic to the Safety Instrumented System (SIS) controllers through a program append operation.(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae0b459d-535d-4895-ac9f-6ec0518afe00",
            "created": "2026-04-22T16:32:26.132Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Ensure embedded controls and network devices are protected through access management, as these devices often have insecure credentials which could be used to gain unauthorized access.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae10e97a-90ac-498b-8601-01081dc4af8b",
            "created": "2021-04-12T18:59:17.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Limit the accounts that may use remote services. Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae1e5c1a-8f2f-4a5a-a262-3d485c20e7a0",
            "created": "2026-04-22T21:43:12.841Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Segment operational networks to isolate critical systems and devices that do not require broad network access.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae20022f-25b5-4eff-8775-53f1e0ad91b8",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae4e86c6-4bbb-4aba-80fc-c20a8f3d63dc",
            "created": "2023-09-28T19:50:14.201Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae7487f1-a2d0-443d-b418-cd726c5ac15f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.162Z",
            "description": "Network connection enumeration is likely obtained by using common system tools (e.g., netstat, ipconfig).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ae7ed6d8-65cc-45a0-82c3-c28e5630bf7c",
            "created": "2023-03-10T20:36:34.109Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.225Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary used a two-way radio to communicate with and set the frequencies of Maroochy Shire's repeater stations.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aec4cb16-bee9-410e-bb74-e3fa70cacf6a",
            "created": "2025-09-24T18:17:46.146Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.163Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af20f409-05ed-42c3-ae3e-09b047b84875",
            "created": "2023-09-25T20:49:25.308Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.163Z",
            "description": "All field controllers should require that user authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af211aeb-17bd-495d-85c5-0790c1197e77",
            "created": "2026-10-07T20:32:54.177Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:32:54.177Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af374cf3-b440-4783-8e1b-243a8dbdeaf4",
            "created": "2023-09-29T18:07:41.540Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af453639-85a4-4dcc-8f6b-b9dbce1a45e4",
            "created": "2026-04-22T22:30:43.151Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af595409-2976-4c01-bfbe-8d9c88f2d697",
            "created": "2025-09-29T19:48:07.839Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af5a7b69-9519-436e-bb58-049b08d82809",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--442e5dcf-7f41-4ba5-ba89-aefb0d1c63cf",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af5c41cb-063d-42a9-ad54-833bd65477d0",
            "created": "2026-04-22T22:38:14.236Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "description": "Ensure systems and devices have an alternative method for communicating in the event that Ethernet communication channels become unavailable.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af802091-fee7-4d15-a845-fb4ee3c26d6d",
            "created": "2023-09-29T16:44:42.393Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--af861c3e-966c-49aa-86c4-a76102977d16",
            "created": "2026-04-23T00:26:01.683Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.164Z",
            "description": "Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.(Citation: IEC February 2019)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--afb0b60e-e604-4b96-abb9-57fdce4e5108",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.165Z",
            "description": "Hot-standbys in diverse locations can ensure continued operations if the primarily system is compromised or unavailable. At the network layer, protocols such as the Parallel Redundancy Protocol can be used to simultaneously use redundant and diverse communication over a local network. (Citation: M. Rentschler and H. Heine)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--afd63145-6033-49e4-ad43-d0b35fa5ed88",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.165Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b050dc4e-4d1c-442a-9824-d7bcb37181f4",
            "created": "2026-04-22T13:53:10.127Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.166Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b05d678b-4d87-4261-9366-f8b757a77661",
            "created": "2024-03-28T14:27:51.356Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.250Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) would programmatically return the controller to a normal running state if the [Triton](https://attack.mitre.org/software/S1009) malware failed. If the controller could not recover in a defined time window, [TEMP.Veles](https://attack.mitre.org/groups/G0088) programmatically overwrote their malicious program with invalid data.(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b0831dd8-64c9-42a8-bf2f-755bdffaca59",
            "created": "2025-09-24T18:23:39.645Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.054Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b0945f9b-5608-472e-ad70-7b42c3e062a1",
            "created": "2023-09-28T21:21:18.081Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.166Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b13417ea-d8da-497f-818f-d2d90562039a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.590Z",
            "description": "Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b1768154-221c-48be-ab2b-549ec1eddafb",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.167Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b1921480-8499-46a9-8396-2a2d747c5861",
            "created": "2023-09-28T19:58:00.892Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b1c35486-c714-4517-9f59-742765773fa3",
            "created": "2023-09-28T20:15:56.470Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b1d993d5-9e7e-4043-a651-07c7b5ad5a6b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:27.602Z",
            "description": "If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b217aaf1-0fe7-43cc-85ad-45b252651e2d",
            "created": "2026-04-23T14:11:52.981Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "description": "The [Industroyer](https://attack.mitre.org/software/S0604) IEC 61850 payload component has the ability to discover relevant devices in the infected host's network subnet by attempting to connect on port 102.(Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b21e0340-976d-44b2-94ae-f777199993c6",
            "created": "2023-09-28T19:39:00.326Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b22637e7-f58c-4c7e-9d76-4b3ee97fa14b",
            "created": "2025-09-29T19:15:08.997Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b22c6faf-0046-4f89-8c5a-4f5ca44b638d",
            "created": "2025-09-29T19:05:33.788Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b252a076-6d4e-49f5-95ac-16264ef05b1d",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov",
                    "description": "Anton Cherepanov   BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry Retrieved. 2019/10/29 ",
                    "url": "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.168Z",
            "description": "[KillDisk](https://attack.mitre.org/software/S0607) is able to delete system files to make the system unbootable and targets 35 different types of files for deletion. (Citation: Anton Cherepanov)",
            "relationship_type": "uses",
            "source_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b270a54c-2a59-46a1-a0b1-4e626bba0b25",
            "created": "2026-10-07T17:40:08.702Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tom Fakterman August 2019",
                    "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:44:24.901Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) utilizes JavaScript, WScript, and PowerShell scripts to execute. The malicious JavaScript attachment has an obfuscated PowerShell script that executes the malware. (Citation: Tom Fakterman August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2823439-efbd-4f91-9a7f-753d40004bc8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--fb0931d5-8eb9-4db2-a2a4-447c32b29bd4",
            "target_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b289c971-3fb7-4c3c-b3d6-cf2702b9384a",
            "created": "2023-09-28T21:10:50.480Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.066Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2b871bc-18fb-46ad-a459-9d3ef06d25ae",
            "created": "2026-10-07T20:19:39.141Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:19:39.141Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2c3e6df-3e82-4b82-bb62-ca219dfdb934",
            "created": "2026-04-22T16:37:53.016Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.169Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2defaaf-625d-416e-8a9d-8be6d89bacdc",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Aditya K Sood July 2019",
                    "description": "Aditya K Sood 2019, July Discovering and fingerprinting BACnet devices Retrieved. 2020/09/25 ",
                    "url": "https://www.helpnetsecurity.com/2019/07/10/bacnet-devices/"
                },
                {
                    "source_name": "Colin Gray",
                    "description": "Colin Gray D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25  How SDN Can Improve Cybersecurity in OT Networks Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6891_HowSDN_CG_20180720_Web2.pdf?v=20190312-231901"
                },
                {
                    "source_name": "D. Parsons and D. Wylie September 2019",
                    "description": "D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25 ",
                    "url": "https://www.csiac.org/journal-article/practical-industrial-control-system-ics-cybersecurity-it-and-ot-have-converged-discover-and-defend-your-assets/"
                },
                {
                    "source_name": "Josh Rinaldi April 2016",
                    "description": "Josh Rinaldi 2016, April Still a Thrill: OPC UA Device Discovery Retrieved. 2020/09/25 ",
                    "url": "https://www.rtautomation.com/rtas-blog/still-a-thrill-opc-ua-device-discovery/"
                },
                {
                    "source_name": "Langner November 2018",
                    "description": "Langner 2018, November Why Ethernet/IP changes the OT asset discovery game Retrieved. 2020/09/25 ",
                    "url": "https://www.langner.com/2018/11/why-ethernet-ip-changes-the-ot-asset-discovery-game/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.169Z",
            "description": "ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.(Citation: D. Parsons and D. Wylie September 2019)(Citation: Colin Gray) Examples of automation protocols with discovery capabilities include OPC UA Device Discovery(Citation: Josh Rinaldi April 2016), BACnet(Citation: Aditya K Sood July 2019), and Ethernet/IP.(Citation: Langner November 2018)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2e10e48-8bd9-472a-9c6f-1d38650e8df1",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS  National Urban Security Technology Laboratory April 2019",
                    "description": "DHS  National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17 ",
                    "url": "https://www.dhs.gov/sites/default/files/saver-msr-rf-detection_cod-508_10july2019.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.169Z",
            "description": "Techniques can include (i) reducing transmission power on wireless signals, (ii) adjusting antenna gain to prevent extensions beyond organizational boundaries, and (iii) employing RF shielding techniques to block excessive signal propagation. (Citation: DHS  National Urban Security Technology Laboratory April 2019)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b2e8914a-91bc-42df-8b64-22e5365ede6f",
            "created": "2023-09-29T17:42:11.005Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b33f2abc-a218-425b-9a90-b75445b7e142",
            "created": "2023-09-29T18:05:51.795Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b340e488-cae9-4c72-a704-ecb5ce7d9348",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c7aea5e8-cd8b-4f79-be41-3a446cdde7b7",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b343e131-e448-46c6-815b-b86e4bd6d638",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Threat Intelligence August 2019",
                    "description": "Dragos Threat Intelligence 2019, August Global Oil and Gas Cyber Threat Perspective Retrieved. 2020/01/03 ",
                    "url": "https://dragos.com/wp-content/uploads/Dragos-Oil-and-Gas-Threat-Perspective-2019.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:42.205Z",
            "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) targeted several ICS vendors and manufacturers. (Citation: Dragos Threat Intelligence August 2019)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3450c17-37c7-4ae1-be7a-21ed8680a0f7",
            "created": "2026-09-25T20:13:07.083Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:13:07.083Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--02744e21-5d1c-4290-820f-d355fc044f50",
            "target_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b346eec8-de90-407c-b665-387086bb4553",
            "created": "2022-09-29T01:36:02.223Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                },
                {
                    "source_name": "Brubaker-Incontroller",
                    "description": "Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045)  can use the CODESYS protocol to upload programs from Schneider PLCs.(Citation: Wylie-22)(Citation: Brubaker-Incontroller) \n\n[INCONTROLLER](https://attack.mitre.org/software/S1045)  can obtain existing program logic from Omron PLCs by using either the program upload or backup functions available through the HTTP server.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b349ef5f-4a05-4eef-afe4-1543b8c832fa",
            "created": "2017-05-31T21:33:27.070Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "iSIGHT Sandworm 2014",
                    "description": "Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.",
                    "url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
                },
                {
                    "source_name": "F-Secure BlackEnergy 2014",
                    "description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
                    "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                },
                {
                    "source_name": "UK NCSC Olympic Attacks October 2020",
                    "description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
                    "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
                },
                {
                    "source_name": "Secureworks IRON VIKING ",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.197Z",
            "description": "(Citation: iSIGHT Sandworm 2014)(Citation: F-Secure BlackEnergy 2014)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)(Citation: Secureworks IRON VIKING )",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b363cbbb-679c-47e0-8ad0-af98ebf51e60",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "description": "Utilize strong cryptographic techniques and protocols to prevent eavesdropping on network communications.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b36d4c7e-2d4e-40ae-ae56-55c94adaf760",
            "created": "2023-09-29T17:59:11.267Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b37844c1-0338-44f6-9116-48fa0f079913",
            "created": "2023-09-29T17:41:11.611Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.170Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3862aa6-7bd0-46a4-83b6-bb687bb7caa6",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Chris Bing May 2018",
                    "description": "Chris Bing 2018, May 24 Trisis masterminds have expanded operations to target U.S. industrial firms Retrieved. 2020/01/03 ",
                    "url": "https://www.cyberscoop.com/xenotime-ics-cyber-attacks-trisis-dragos/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:42.212Z",
            "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) utilizes watering hole websites to target industrial employees. (Citation: Chris Bing May 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3aab26c-09c6-4264-af2a-5df260d3d8e2",
            "created": "2023-09-28T19:48:58.160Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.171Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3b24837-83ed-46c5-ba80-66a832c7072e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.171Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3b289bf-da9d-40b2-bedd-ca1b65271825",
            "created": "2023-10-02T20:18:11.933Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.171Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3f2990b-855e-49f3-b657-6b24118b2d19",
            "created": "2025-09-29T19:48:23.823Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.171Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3f29beb-4a3d-48c6-93ac-136646236a1a",
            "created": "2026-09-26T03:33:16.431Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:33:16.431Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b3f2dffc-b79d-4de0-85eb-2d3238a4f36b",
            "created": "2026-04-20T20:54:21.776Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:21.776Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b411f748-a1e9-40c6-8eb3-72f2de4dab08",
            "created": "2023-09-28T20:02:20.170Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.171Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b4407f32-7f6c-4efa-861d-92f6cc116b0b",
            "created": "2026-10-07T20:08:35.968Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:08:35.968Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b452a076-6d4e-49f5-95ac-16264ef05b1d",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov",
                    "description": "Anton Cherepanov   BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry Retrieved. 2019/10/29 ",
                    "url": "https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.172Z",
            "description": "[KillDisk](https://attack.mitre.org/software/S0607) looks for and terminates two non-standard processes, one of which is an ICS application. (Citation: Anton Cherepanov)",
            "relationship_type": "uses",
            "source_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "target_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b47dbc50-fd8f-4e5b-bb3d-e93b68bf5497",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.172Z",
            "description": "Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b48a9fea-26a5-473c-9a5d-fcc3531e1fd3",
            "created": "2023-03-30T18:59:30.677Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.172Z",
            "description": "Develop and publish policies that define acceptable information to be stored on local systems.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b4efcbe0-ffe3-4d9a-8dba-570e68494af1",
            "created": "2023-03-10T20:10:23.377Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.233Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary falsified network addresses in order to send false data and instructions to pumping stations.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b58d2485-55f4-45ee-b2e1-6e067ae8d81b",
            "created": "2026-04-22T22:34:12.580Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.173Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b58f623d-c61f-46e8-b356-09af226ba9ad",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.173Z",
            "description": "Perform integrity checks of firmware before uploading it on a device. Utilize cryptographic hashes to verify the firmware has not been tampered with by comparing it to a trusted hash of the firmware. This could be from trusted data sources (e.g., vendor site) or through a third-party verification service.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b59a96e4-bd70-4459-9609-66563bccd9c3",
            "created": "2023-09-29T16:38:21.688Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.173Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b5aa325c-4897-4e57-acdc-3c0df05b442e",
            "created": "2026-10-07T21:21:59.466Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:21:59.466Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b5ab26e2-eb90-4f19-b35a-b8a0a5438961",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Hydro",
                    "description": "Hydro Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16  Retrieved. 2019/10/16 ",
                    "url": "https://www.hydro.com/en/media/on-the-agenda/cyber-attack/"
                },
                {
                    "source_name": "Kevin Beaumont",
                    "description": "Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ",
                    "url": "https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.173Z",
            "description": "Some of Norsk Hydro's production systems were impacted by a [LockerGoga](https://attack.mitre.org/software/S0372) infection. This resulted in a loss of control which forced the company to switch to manual operations. (Citation: Kevin Beaumont) (Citation: Hydro)",
            "relationship_type": "uses",
            "source_ref": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b5bb5ec3-aa3c-4734-8425-4be80c5658a9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.173Z",
            "description": "This technique may not be effectively mitigated against, consider controls for assets and processes that lead to the use of this technique.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b5e52859-8dab-4e7e-af70-bb38c6993c98",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "description": "Preventing screen capture on a device may require disabling various system calls supported by the operating systems (e.g., Microsoft Windows.Graphics.Capture APIs), however, these may be needed for other critical applications.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433",
            "target_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b628d878-4f35-4580-8d42-26984d13821e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b6309476-8268-4c47-920b-8a556cd8ae4c",
            "created": "2023-09-29T18:47:07.359Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b6483471-f9b5-43f1-8da3-6b69e180d46d",
            "created": "2026-10-07T21:41:16.628Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:41:16.628Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b69905bd-6865-4092-9543-47bd9ae318ec",
            "created": "2023-09-28T19:54:22.618Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b69f31c3-6c12-4b81-8e74-9c58ea635fa4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA June 2013",
                    "description": "CISA 2013, June Risks of Default Passwords on the Internet Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/ncas/alerts/TA13-175A"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "description": "Ensure that applications and devices do not store sensitive data or credentials insecurely (e.g., plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage). (Citation: CISA June 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8a3aadd0-b5f4-433a-800e-4893e4196bb7",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b6a51a26-94fd-419f-b0c1-cc61e02e1475",
            "created": "2025-09-24T18:14:21.405Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.174Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b6f48e41-f7a9-45ca-b445-9e262dd307a2",
            "created": "2025-09-29T19:54:47.976Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.175Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7052528-c465-403a-8a2a-8b1e69fc771a",
            "created": "2026-10-07T21:44:52.785Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:44:52.785Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b720b42c-5eba-4164-9c3d-8b4eabde4716",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--194cb4dd-81ca-4e64-94e2-911fab1219f9",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7284360-0d80-45bb-8486-263ae8f8fa63",
            "created": "2023-09-28T21:26:01.106Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.175Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b72b7dfd-f134-4324-84b8-52ff13fc6b5c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.175Z",
            "description": "Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7344dfb-621b-4558-ab22-6c1f256ee746",
            "created": "2023-09-29T16:46:27.408Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.175Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b774fcb4-43bf-4ff1-98c6-0a94838eacc2",
            "created": "2023-09-29T18:57:10.064Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.176Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7943cdb-1a6b-46cf-aebe-8282fd86c357",
            "created": "2025-09-24T18:04:00.774Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.176Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7a32080-49ce-432f-8b75-abd944be4e82",
            "created": "2023-09-28T20:11:52.625Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.176Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7a9bff5-2e15-4d3d-ac88-84af1239a586",
            "created": "2023-09-28T19:51:42.728Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.176Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7f23af2-e948-4531-af56-1a1b4d03702f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.176Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b80545f9-cf00-4ef1-8c45-e325d9447f98",
            "created": "2026-10-07T19:39:05.181Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T19:39:05.181Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b84e1473-f370-42ad-ac3b-7caf3c8cd00e",
            "created": "2023-09-29T18:42:53.573Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.654Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8c33196-8fc2-4855-b764-cd49554f0223",
            "created": "2026-04-22T20:28:21.888Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Aditya K Sood July 2019",
                    "description": "Aditya K Sood 2019, July Discovering and fingerprinting BACnet devices Retrieved. 2020/09/25 ",
                    "url": "https://www.helpnetsecurity.com/2019/07/10/bacnet-devices/"
                },
                {
                    "source_name": "Colin Gray",
                    "description": "Colin Gray D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25  How SDN Can Improve Cybersecurity in OT Networks Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6891_HowSDN_CG_20180720_Web2.pdf?v=20190312-231901"
                },
                {
                    "source_name": "D. Parsons and D. Wylie September 2019",
                    "description": "D. Parsons and D. Wylie 2019, September Practical Industrial Control System (ICS) Cybersecurity: IT and OT Have Converged  Discover and Defend Your Assets Retrieved. 2020/09/25 ",
                    "url": "https://www.csiac.org/journal-article/practical-industrial-control-system-ics-cybersecurity-it-and-ot-have-converged-discover-and-defend-your-assets/"
                },
                {
                    "source_name": "Josh Rinaldi April 2016",
                    "description": "Josh Rinaldi 2016, April Still a Thrill: OPC UA Device Discovery Retrieved. 2020/09/25 ",
                    "url": "https://www.rtautomation.com/rtas-blog/still-a-thrill-opc-ua-device-discovery/"
                },
                {
                    "source_name": "Langner November 2018",
                    "description": "Langner 2018, November Why Ethernet/IP changes the OT asset discovery game Retrieved. 2020/09/25 ",
                    "url": "https://www.langner.com/2018/11/why-ethernet-ip-changes-the-ot-asset-discovery-game/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.177Z",
            "description": "ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.(Citation: D. Parsons and D. Wylie September 2019)(Citation: Colin Gray) Examples of automation protocols with discovery capabilities include OPC UA Device Discovery(Citation: Josh Rinaldi April 2016), BACnet(Citation: Aditya K Sood July 2019), and Ethernet/IP.(Citation: Langner November 2018)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8ce3f0c-7c11-4846-b567-a5d4233b0e6e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.177Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8d6e550-18fe-49ad-9964-7802bbe0cb58",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.177Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8e71df0-20c4-42b0-8d80-68e93fc084c2",
            "created": "2026-04-22T20:13:51.408Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.928Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used default credentials to access Hitatchi RTUs, Mikronika RTUs, Hitachi Relion Protection and Control Relays, Mikronika HMI Computers, and Moxa NPort Serial Device Servers.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8edcf0a-ec53-4203-b3ad-2cc734a1f1dd",
            "created": "2021-10-14T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "description": "Update software on control network assets when possible. If feasible, use modern operating systems and software to reduce exposure to known vulnerabilities.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8f6d6a8-e668-4596-8ec2-41c5d1bd211d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "description": "All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b9608e90-25f7-4a0a-b621-5512827ac169",
            "created": "2023-09-29T17:38:59.611Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b9632b4d-43c3-4bfa-88e0-629245acb8eb",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "description": "Ensure users and user groups have appropriate permissions for their roles through Identity and Access Management (IAM) controls to prevent misuse. Implement user accounts for each individual that may access the repositories for role enforcement and non-repudiation of actions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e57ebc6d-785f-40c8-adb1-b5b5e09b3b48",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b9a1e946-4ece-48f3-949c-e1c2d39136fe",
            "created": "2025-09-29T19:14:59.837Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b9b45f7a-742f-4b72-bdee-577ceb539499",
            "created": "2026-04-23T14:16:22.262Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
                    "description": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ",
                    "url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.178Z",
            "description": "[PLC-Blaster](https://attack.mitre.org/software/S1006) scans the network to find other Siemens S7 PLC devices to infect. It locates these devices by checking for a service listening on TCP port 102.(Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)",
            "relationship_type": "uses",
            "source_ref": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b9e82422-b072-494f-99c1-fcab07b90133",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "description": "Require signed binaries.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba010007-6dde-4c9d-8452-69527cd1c2ba",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "description": "Minimize permissions and access for service accounts to limit the information that may be exposed or collected by malicious users or software. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba24af7b-dd2f-4c21-9ec5-27758b88da9b",
            "created": "2025-09-29T19:57:16.248Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba394cbc-461d-44cc-8fa5-92f11a5c8e6b",
            "created": "2026-04-22T18:53:03.069Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:55.469Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--6bdde391-76eb-4bd7-9e19-e805ab98b7ac",
            "target_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba496af3-2d99-4c2b-8ce0-20388f5d632c",
            "created": "2023-09-28T21:28:36.325Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba49c0ad-293e-46c3-a0f9-30a25dba415a",
            "created": "2023-09-28T19:51:27.775Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba943eeb-5673-44b5-acbf-1cddc2fefb1a",
            "created": "2023-09-28T20:03:54.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.179Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ba9ebebf-d5dd-4a5c-b44f-a07cc3ccac8b",
            "created": "2023-09-27T14:48:05.715Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.100Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) blocked command messages by using malicious firmware to render serial-to-ethernet converters inoperable. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bac1f95c-87bf-4939-bc1a-7727aad738f7",
            "created": "2023-09-29T18:49:34.208Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.180Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bad056aa-b8a6-4c4c-9bfa-bcc518872341",
            "created": "2024-03-25T20:17:36.433Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.180Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--badf753a-349e-4a3c-a425-b12efd65d856",
            "created": "2026-04-20T20:58:44.598Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:44.598Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--b9160e77-ea9e-4ba9-b1c8-53a3c466b13d",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--baf4bd30-4213-43c3-b70c-54418e734caf",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.180Z",
            "description": "Filter for protocols and payloads associated with program upload activity to prevent unauthorized access to device configurations.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--baf7daf3-2116-4051-91b5-f82e146167d0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.181Z",
            "description": "Routinely audit source code, application configuration files, open repositories, and public cloud storage for insecure use and storage of credentials.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bb3938a6-85ec-4f34-8bcd-6051de7e9259",
            "created": "2023-09-29T16:45:08.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.181Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bbbbad6d-fc22-4f87-92e6-445f05e08e39",
            "created": "2026-04-22T21:40:21.108Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.181Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bbeb2eae-7da2-4477-ad8e-8c67b00c53bc",
            "created": "2023-09-28T19:53:44.848Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc0e4ff7-ed61-41c0-84ca-66210241c9ce",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc3744d6-9275-4d91-8888-16d5f4d5187b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "description": "Use least privilege for service accounts. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc383819-2e40-49b4-bea9-95eb5d418877",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) uses a thread to monitor a data block DB890 of sequence A or B. This thread is constantly running and probing this block (every 5 minutes). On an infected PLC, if block DB890 is found and contains a special magic value (used by Stuxnet to identify his own block DB890), this blocks data can be read and written. This thread is likely used to optimize the way sequences A and B work, and modify their behavior when the Step7 editor is opened. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc3a0b1f-f0ec-466f-8cad-8f47b07764c9",
            "created": "2023-09-28T21:22:21.776Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.080Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc475267-c604-4f40-8876-ec4b375025f1",
            "created": "2026-09-25T18:47:01.224Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:47:01.224Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--f8400e7d-3443-4205-aaf3-1592b777416f",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc51e6c7-6211-4124-874d-4a5aea2efce0",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "description": "Using its protocol payloads, [Industroyer](https://attack.mitre.org/software/S0604) sends unauthorized commands to RTUs to change the state of equipment. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc6f2a51-9307-4268-a6d6-51c02ae893fd",
            "created": "2023-09-29T17:58:04.082Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc74ff8f-d5fa-40fb-8c0b-f16af3ff36e3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.182Z",
            "description": "Apply DLP to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--337c4e2a-21a7-4d9a-bfee-9efd6cebf0e5",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bcece7ce-91b5-40b3-b87a-25cab3600e5c",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.666Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) attempts to contact command and control servers on port 80 to send basic information about the computer it has compromised. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd16f422-4869-49f8-9b86-16220e857c9b",
            "created": "2025-09-29T22:07:11.671Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd2ee84f-349c-4a89-b224-d48269bd9b0a",
            "created": "2026-04-22T22:47:25.522Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd639f3c-0887-49a6-9274-37e1e2d24808",
            "created": "2025-09-24T18:21:25.236Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd7bd67c-f636-481f-a301-7e8da69b5aef",
            "created": "2026-04-22T18:58:48.061Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd821f38-4517-4461-9bc9-d084ccd2721e",
            "created": "2026-10-07T21:41:40.320Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:41:40.320Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd869385-5778-4303-8993-cc6412d12303",
            "created": "2023-09-29T18:45:59.108Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bda03e8d-5e06-4470-b786-11b11c7c97c7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.184Z",
            "description": "Deploy anti-virus on all systems that support external email.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bdae915d-64f8-4944-949c-59a4d35b70c5",
            "created": "2026-04-22T20:26:28.411Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.936Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries damaged the Mikronika RTUs, Hitachi Relion Protection and Control Relays (IEDs), and HMI workstations resulting in a loss of communications and control between the facility and the distribution system operators (DSO).(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bde941c6-2ca0-4f94-9336-027e7eee15a1",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.679Z",
            "description": "Configure internal and external firewalls to block traffic using common ports that associate to network protocols that may be unnecessary for that particular network segment.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--be0f7d83-2441-4259-b411-46e0d10566b1",
            "created": "2023-10-02T20:23:24.179Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.185Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--be532c78-daf5-431b-adae-ab11af395513",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.185Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) executes malicious SQL commands in the WinCC database server to propagate to remote systems. The malicious SQL commands include xp_cmdshell, sp_dumpdbilog, and sp_addextendedproc. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--be950e87-80ac-49ea-810a-553c7f72151b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.186Z",
            "description": "Devices should authenticate all messages between master and outstation assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--beb0c5be-2b81-4d8d-9d9f-35e496be4e0f",
            "created": "2026-04-23T00:26:38.917Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.186Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bf08412c-f1ab-4b48-956b-177ce2474a2e",
            "created": "2026-04-22T22:35:15.009Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.186Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bf0e7347-1636-4b5e-9e2a-8b93177e5f85",
            "created": "2024-03-28T14:27:09.365Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON 2018",
                    "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.269Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) used valid credentials when laterally moving through RDP jump boxes into the ICS environment.(Citation: FireEye TRITON 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bf8f90a2-4d3a-436d-87d0-eff060fb2302",
            "created": "2023-09-29T18:06:02.077Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.187Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bf9f227c-e306-4257-add1-39c7c2e42040",
            "created": "2023-09-29T18:47:28.758Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.187Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bfe38597-c92b-4989-9687-3dd20a21f82d",
            "created": "2025-09-29T19:05:45.030Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.188Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bff99f91-e1a9-4379-a2d9-5a99615a95d1",
            "created": "2020-09-22T19:41:27.951Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Secureworks REvil September 2019",
                    "description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                },
                {
                    "source_name": "Secureworks GandCrab and REvil September 2019",
                    "description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:46.061Z",
            "description": "(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133",
            "target_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c004d8e5-8079-4f6f-90ed-93cff4f69940",
            "created": "2025-09-24T18:14:07.949Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.188Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c047df7c-3ed7-455f-8b13-14ced8e93fef",
            "created": "2023-09-28T21:17:47.080Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.188Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c09375e4-1c59-48f2-9151-f42151263bce",
            "created": "2026-04-22T19:59:54.754Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:19.944Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used a graphical user interface (GUI) via the Remote Desktop Protocol (RDP) to access the Mikronika HMI and to execute commands.(Citation: CERT Polska)\n\nDuring the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used a graphical user interface (GUI) to connect to the domain controller via the Remote Desktop Protocol (RDP) to collect and exfiltrate data and attempt to destroy data on the system.(Citation: CERT Polska)\n",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c09623fc-ee06-4d8e-828f-23d2bc895aaf",
            "created": "2026-04-22T21:39:27.046Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.189Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c0efb24a-2329-401a-bba6-817f2867bb3f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.189Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c0fb868d-9b36-492d-9577-626ecf9d50c0",
            "created": "2025-09-29T22:02:30.857Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.189Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c107c735-71bd-427c-879f-195a323e5769",
            "created": "2026-10-07T20:30:30.035Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:30:30.035Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c1154a56-6f5f-4760-8b34-79b0e8a79c1f",
            "created": "2023-03-10T20:34:55.362Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.241Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary suppressed alarm reporting to the central computer.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c137fcd2-ce51-4e17-9c2f-f1aaf9b64ce7",
            "created": "2024-03-28T14:28:47.109Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TEMP.Veles 2018",
                    "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
                    "url": "https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.328Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) made attempts on multiple victim machines to transfer and execute the WMImplant tool.(Citation: FireEye TEMP.Veles 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c1849779-3ef0-4e68-b970-a518976a7567",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--06443942-ba28-4d13-b4b4-93317d6eafa5",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c195a0e9-d46c-487f-9a96-b138e9ca05d2",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.190Z",
            "description": "Consider restricting access to email within critical process environments. Additionally, downloads and attachments may be disabled if email is still necessary.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c19a88bb-b98c-4a2e-9b8f-9dcacd73a9c0",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c7737640-99e8-4efb-90ee-39332b623b33",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c1d77f83-23ec-4128-afd1-ed8ea12281a2",
            "created": "2023-09-29T18:09:02.311Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.190Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c1e051ab-0a11-4d29-b98f-aa442ab69553",
            "created": "2023-09-29T17:09:48.178Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.190Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c1fc8829-4a5e-4633-8785-b5601f5067a9",
            "created": "2025-09-29T19:02:37.703Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.190Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c233df49-e450-4151-8a0f-1765faf3d75a",
            "created": "2023-09-29T17:08:08.883Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.191Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c247e63d-f1f8-4b69-b72f-866bfd14d4bb",
            "created": "2026-04-22T16:10:21.873Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.191Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c27e676e-1ac0-4ec8-bf9d-f540969c6b6f",
            "created": "2023-09-29T17:59:54.204Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.191Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c297179c-66a5-41b4-9a12-59f7480bc25e",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--5ba60cf7-738d-4ed4-827c-8c763ad9f0f0",
            "target_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c2a6b6b8-d9ef-45e1-9b7f-5fdc039e190f",
            "created": "2023-09-29T16:39:01.824Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.191Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c2fe42b4-6750-4b51-86b7-6c37fbfdef2d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.192Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c347b69c-e3f6-4eca-ba57-0781c7dc8eac",
            "created": "2021-04-13T12:28:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Threat Intelligence February 2020",
                    "description": "Dragos Threat Intelligence 2020, February 03 EKANS Ransomware and ICS Operations Retrieved. 2021/04/12 ",
                    "url": "https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.192Z",
            "description": "[EKANS](https://attack.mitre.org/software/S0605) masquerades itself as a valid executable with the filename update.exe. Many valid programs use the process name update.exe to perform background software updates. (Citation: Dragos Threat Intelligence February 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c37f097a-9698-412f-9e96-4d350bcd2790",
            "created": "2023-09-29T16:44:26.728Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.192Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c39be68a-e208-47ac-a7be-6eb6e84d6608",
            "created": "2023-09-29T18:49:14.639Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.193Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c3c23e7f-f778-4cd6-b2ac-69c1a5615d66",
            "created": "2026-04-22T22:32:35.367Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.193Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4122b58-f1b2-4656-a715-55016700bf75",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.193Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) automatically collects protocol object data to learn about control devices in the environment. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c41d20c8-b99e-4de8-a0e5-3e0ef3b4275b",
            "created": "2023-10-02T20:21:06.420Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.193Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c44ad0d0-0d7e-4a31-877b-ac69b679cf8d",
            "created": "2025-09-24T18:04:13.732Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.193Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4a50132-a210-4093-878d-3d6df23ed26e",
            "created": "2023-09-29T17:10:09.146Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.194Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4b036ee-be86-48cb-9f01-ab8f78e5bb37",
            "created": "2023-09-28T20:15:05.405Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.194Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4dd7251-ed87-4629-86b5-090e52a82df2",
            "created": "2024-04-09T21:00:32.387Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.194Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4fa7c43-1b74-4d65-ade9-72b679f4bb49",
            "created": "2025-09-29T19:56:59.071Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.194Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c52501e6-6c33-4c10-9c20-b868f71f8035",
            "created": "2025-09-24T18:24:47.882Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.195Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c53a4f46-f8db-4d89-b21b-9f249c8297a1",
            "created": "2025-09-29T19:59:07.775Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.195Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c563bfb5-173f-4a96-812b-2aad8057f09f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.339Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--62587e44-0623-4b14-bd45-126430eaed4a",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c56f7ce6-a077-41d3-94d7-440f85e61786",
            "created": "2026-04-22T13:55:20.869Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.195Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c58563a8-d757-4476-8ae2-beb2acce38b3",
            "created": "2023-10-02T20:20:55.473Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.195Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c596f45a-ad65-4673-b316-05378175f35e",
            "created": "2024-04-09T20:54:19.196Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c59a3d89-c8fa-4c5d-813e-f4495d892d1a",
            "created": "2019-03-25T19:13:54.947Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "description": "[WannaCry](https://attack.mitre.org/software/S0366) initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c5a69738-3e80-421d-aba2-bdab8a4029fd",
            "created": "2023-09-29T18:43:49.839Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c5dd0d66-99f1-4efd-b0f9-bf9f9118ff16",
            "created": "2020-06-10T18:36:54.638Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Trend Micro Cyclops Blink March 2022",
                    "description": "Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.",
                    "url": "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"
                },
                {
                    "source_name": "NCSC Sandworm Feb 2020",
                    "description": "NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.",
                    "url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
                },
                {
                    "source_name": "mandiant_apt44_unearthing_sandworm",
                    "description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
                    "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
                },
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                },
                {
                    "source_name": "Secureworks IRON VIKING ",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                },
                {
                    "source_name": "UK NCSC Olympic Attacks October 2020",
                    "description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
                    "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.264Z",
            "description": "(Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)(Citation: Secureworks IRON VIKING )(Citation: Trend Micro Cyclops Blink March 2022)(Citation: mandiant_apt44_unearthing_sandworm)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--5719af9d-6b16-46f9-9b28-fb019541ddbb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c5fd0969-c151-4849-94c2-83e2e208cff7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "description": "Ensure that wired and/or wireless traffic is encrypted when feasible. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS. (Citation: Keith Stouffer May 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--7f153c28-e5f1-4764-88fb-eea1d9b0ad4a",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c610871a-a31d-4597-8e44-f694dfe9c5b8",
            "created": "2026-10-07T21:15:57.384Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:15:57.384Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c613899c-1550-4a90-8ae9-7a964147093f",
            "created": "2025-09-29T19:14:51.386Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c617dafd-fb30-41e2-bf5d-1287d826dcd1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--e6bc5359-4bd4-4688-9136-ac7a6b561f56",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c61fb9cc-8a3c-46e6-8ae6-856aa7f16723",
            "created": "2026-04-22T21:41:52.241Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c6258ef7-95dc-43ef-b0c2-a20011a48699",
            "created": "2026-04-22T22:37:37.395Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "description": "Implement network allowlists to minimize network access to only authorized hosts.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c64c1841-bd66-4651-b751-ee3d54962790",
            "created": "2026-10-07T20:20:25.480Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:20:25.480Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c64f2ed2-f7a7-4333-b0d3-d687ffb7ad6b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c6520346-fe47-44ce-af75-d99004ac2977",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.196Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c65e39eb-f6d1-4e3a-9070-b2fa7ea35b36",
            "created": "2023-09-28T21:27:50.246Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.197Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c67e3535-69a9-4234-8170-4ad6efc632b7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "OWASP",
                    "description": "OWASP   Top 10 Web Application Security Risks Retrieved. 2020/09/25 ",
                    "url": "https://owasp.org/www-project-top-ten/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.197Z",
            "description": "Implement continuous monitoring of vulnerability sources. Also, use automatic and manual code review tools. (Citation: OWASP)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c69eab3c-861c-45f5-8858-a595fcc7e6f6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "University of Birmingham C2",
                    "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
                    "url": "https://arxiv.org/pdf/1408.1136"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.350Z",
            "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.(Citation: University of Birmingham C2)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c71fafe8-ed54-44d1-be6e-9a018eb9a90f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--d8cb1dd3-8bf2-48e7-99db-473481b823a8",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c78f497f-01c3-4efb-aa74-92b700b9c02b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.198Z",
            "description": "When at rest, project files should be encrypted to prevent unauthorized changes.(Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.198Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c7ab3b87-4a54-4a24-9ed0-1ed360c3e03e",
            "created": "2026-09-25T18:29:28.505Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:29:28.505Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c7ae1f86-2029-4354-896b-baace526bf3c",
            "created": "2026-04-22T13:56:41.640Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.198Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c7c75b98-3fb2-46fd-93de-4e59f3181dae",
            "created": "2026-04-20T20:58:49.920Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:49.920Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--c9a8d958-fcdb-40d2-af4c-461c8031651a",
            "target_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c7fdb9b7-2155-4a8a-94f2-9a82f7c3b13f",
            "created": "2026-10-07T20:37:23.011Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:37:23.011Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c80a479e-5e7b-449b-ace0-b5ced0d2d442",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--60a55b7b-29a5-437e-83a7-edbe6f3c4415",
            "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8222300-6c5e-42d6-ae67-3595407b89fd",
            "created": "2024-04-09T20:54:39.801Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.199Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8385036-b439-4360-8a56-cb595511e239",
            "created": "2026-09-25T18:33:26.971Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos October 2018",
                    "description": "Dragos 2018, October 12 Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE Retrieved. 2019/10/14 ",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:33:26.971Z",
            "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. (Citation: Dragos October 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c",
            "created": "2022-05-06T17:47:21.168Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Carl Hurd March 2019",
                    "description": "Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 ",
                    "url": "https://www.youtube.com/watch?v=yuZazP22rpI"
                },
                {
                    "source_name": "William Largent June 2018",
                    "description": "William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 ",
                    "url": "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.199Z",
            "description": "The [VPNFilter](https://attack.mitre.org/software/S1010)'s ssler module configures the device's iptables to redirect all traffic destined for port 80 to its local service listening on port 8888. Any outgoing web requests on port 80 are now intercepted by ssler and can be inspected by the ps module and manipulated before being sent to the legitimate HTTP service. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c892fb0a-4c9f-4332-a0d3-974a8fcab565",
            "created": "2026-04-20T20:54:22.907Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:22.907Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6",
            "created": "2021-04-12T17:00:17.249Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Robert A. Martin January 2021",
                    "description": "Robert A. Martin 2021, January TRUSTING OUR SUPPLY CHAINS: A COMPREHENSIVE DATA-DRIVEN APPROACH Retrieved. 2021/04/12 ",
                    "url": "https://www.mitre.org/sites/default/files/publications/pr-20-01465-37-trusting-our-supply-chains-a-comprehensive-data-driven-approach.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.199Z",
            "description": "A supply chain management program should include methods the assess the trustworthiness and technical maturity of a supplier, along with technical methods (e.g., code-signing, bill of materials) needed to validate the integrity of newly obtained devices and components. Develop procurement language that emphasizes the expectations for suppliers regarding the artifacts, audit records, and technical capabilities needed to validate the integrity of the devices supply chain. (Citation: Robert A. Martin January 2021)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ac8f3492-7fbb-4a0a-b0b4-b75ec676136c",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8c5e01d-cf78-402c-9f52-6f5c306fd300",
            "created": "2026-04-22T18:58:29.496Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.200Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8d9d10f-bf72-4340-a613-fa08f2dde557",
            "created": "2026-09-25T16:48:19.176Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye TRITON Dec 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 12, 2018.",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T16:48:19.176Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088)’ tool took one option from the command line, which was a single IP address of the target Triconex device.(Citation: FireEye TRITON Dec 2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8dd2735-bd04-4413-847d-316b77c6de19",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.091Z",
            "description": "Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in the [Filter Network Traffic](https://attack.mitre.org/mitigations/M0937) mitigation.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a",
            "created": "2023-09-27T13:22:13.265Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.125Z",
            "description": "(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c9065f74-556d-4728-8072-f96642e70316",
            "created": "2021-04-12T18:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.200Z",
            "description": "Access Management technologies can help enforce authentication on critical remote service, examples include, but are not limited to, device management services (e.g., telnet, SSH), data access servers (e.g., HTTP, Historians), and HMI sessions (e.g., RDP, VNC).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "SecureWorks September 2019",
                    "description": "SecureWorks 2019, September 24 REvil/Sodinokibi Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                },
                {
                    "source_name": "Tom Fakterman August 2019",
                    "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
                    "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.200Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) sends HTTPS POST messages with randomly generated URLs to communicate with a remote server. (Citation: Tom Fakterman August 2019) (Citation: SecureWorks September 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c91514db-4e02-459e-9ff4-5092fdffb049",
            "created": "2026-04-23T00:39:44.358Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.200Z",
            "description": "Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c9395e2a-afaf-427c-bcb2-ae663d72c05c",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.200Z",
            "description": "Provide an alternative method for alarms to be reported in the event of a communication failure.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c95850f4-4616-435c-b237-f1985833d40e",
            "created": "2023-09-29T16:29:39.918Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.201Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--97914ffd-b189-415e-9309-e63e3be01b1e",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c9efe378-d028-4c09-83c7-491fadc3a1f9",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--09f46edf-33f9-4c23-af2f-74864c27f616",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c9fb4adb-8064-426a-838d-c93674fb380b",
            "created": "2023-09-29T18:44:38.035Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.201Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca13a117-aae0-4802-878b-c09f4a04dd31",
            "created": "2023-09-28T20:06:50.018Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.201Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca225ea0-e813-4205-98db-707b474ae24f",
            "created": "2024-04-09T20:49:44.575Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.201Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Anton Cherepanov, ESET June 2017",
                    "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.202Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604)'s OPC module can brute force values and will send out a 0x01 status which for the target systems equates to a Primary Variable Out of Limits misdirecting operators from understanding protective relay status. (Citation: Anton Cherepanov, ESET June 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca5c7ae7-5273-4888-bc50-183d6e200972",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.202Z",
            "description": "Built-in browser sandboxes and application isolation may be used to contain web-based malware.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca64a927-f050-41b3-80d3-93d22cdef26a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.692Z",
            "description": "Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca768c2a-0f14-471c-90a5-bce649e88d51",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.202Z",
            "description": "Application denylists can be used to block automation protocol functions used to initiate device shutdowns or restarts, such as DNP3's 0x0D function code, or vulnerabilities that can be used to trigger device shutdowns (e.g., CVE-2014-9195, CVE-2015-5374).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca77cbbf-8938-4dd0-b454-df5703bc1718",
            "created": "2026-04-22T17:55:35.905Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:54.499Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--31773402-e407-4ed3-b86c-7a8587dc5ec9",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cad91f87-7cc7-4771-8c7b-1599793ed3c1",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Carl Hurd March 2019",
                    "description": "Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 ",
                    "url": "https://www.youtube.com/watch?v=yuZazP22rpI"
                },
                {
                    "source_name": "William Largent June 2018",
                    "description": "William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 ",
                    "url": "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.202Z",
            "description": "The [VPNFilter](https://attack.mitre.org/software/S1010) packet sniffer looks for basic authentication as well as monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. Packets that are not on port 502, are scanned for BasicAuth, and that information is logged. This may have allowed credential harvesting from communications between devices accessing a modbus-enabled HMI. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cae90fbb-ba0d-4a9a-9da3-b9f32ab1cd07",
            "created": "2026-04-23T00:38:14.226Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "IEC February 2019",
                    "description": "IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ",
                    "url": "https://webstore.iec.ch/publication/34421"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.202Z",
            "description": "Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.(Citation: IEC February 2019)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b",
            "created": "2021-10-04T20:52:20.304Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Lazarus KillDisk April 2018",
                    "description": "Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.",
                    "url": "https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:23.388Z",
            "description": "(Citation: ESET Lazarus KillDisk April 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
            "target_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb47a3bb-daec-4aa1-9a92-af2a61bb65cd",
            "created": "2023-09-28T21:14:29.099Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "description": "Encrypt any operational data with strong confidentiality requirements, including organizational trade-secrets, recipes, and other intellectual property (IP).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb6d67c0-33ba-4c49-ae70-d0e4f0f68794",
            "created": "2023-03-30T14:08:42.386Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "description": "Retain cold-standby or replacement hardware of similar models to ensure continued operations of critical functions if the primary system is compromised or unavailable. (Citation: M. Rentschler and H. Heine)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb6e6679-42b7-48ce-b546-7c45cdefb4c5",
            "created": "2023-09-28T20:01:52.459Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb7b5a86-1591-407d-a3cf-c7f86f60934b",
            "created": "2026-10-07T21:56:35.264Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:56:35.264Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb7fc6bb-f62d-4316-91d3-ecab283e2976",
            "created": "2023-09-29T18:56:34.302Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb84ce4c-4fb7-4e16-b10c-c932d34f0699",
            "created": "2026-04-22T21:36:37.108Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cb993689-bb59-4c96-b9fd-42cfcb92d76f",
            "created": "2026-04-22T16:03:21.013Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Research Whitepapers September 2018",
                    "description": "ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"
                },
                {
                    "source_name": "Intel",
                    "description": "Intel ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25  Intel Hardware-based Security Technologies for Intelligent Retail Devices Retrieved. 2020/09/25 ",
                    "url": "https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf"
                },
                {
                    "source_name": "N/A",
                    "description": "N/A   Trusted Platform Module (TPM) Summary Retrieved. 2020/09/25 ",
                    "url": "https://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.203Z",
            "description": "Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology.(Citation: N/A) Move system's root of trust to hardware to prevent tampering with the SPI flash memory.(Citation: ESET Research Whitepapers September 2018) Technologies such as Intel Boot Guard can assist with this.(Citation: Intel)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8ac1d6e1-b07f-476a-9732-84984ebc2405",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cba8313b-c338-45f7-88ef-a514094882ac",
            "created": "2022-09-28T20:28:39.348Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.204Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) has the ability to exploit a vulnerable Asrock driver (AsrDrv103.sys) using CVE-2020-15368 to load its own unsigned driver on the system.(Citation: Wylie-22)",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cbc62104-d3df-499c-9630-b510e99f3acd",
            "created": "2025-09-29T19:07:05.860Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.204Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cbc65a60-3b40-4ecf-a10d-8ef1be72568d",
            "created": "2024-04-09T20:54:26.301Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.204Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cbee31a0-716c-4b10-83f0-aa889bfb4749",
            "created": "2023-10-20T17:05:25.595Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.204Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cc1f9236-42f2-463f-9894-44197fbe2867",
            "created": "2023-09-29T16:39:09.447Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.204Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cc5c77ce-c5a3-4791-b80e-09d35282443a",
            "created": "2023-09-29T16:30:08.166Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cca191a1-3c50-4d4f-8f79-4247e58af610",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "description": "Use tools that restrict program execution via application control by attributes other than file name for common system and application utilities.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ccae6e5d-8a9e-4bab-ae77-26a2bd722f67",
            "created": "2021-04-13T11:15:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) infects OB1 so that its malicious code sequence is executed at the start of a cycle. It also infects OB35. OB35 acts as a watchdog, and on certain conditions, it can stop the execution of OB1. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ccbb44ad-2220-4260-99ce-9142c44fc797",
            "created": "2023-09-28T21:10:03.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ccc5523f-b7a7-4bd1-a9a2-eb00f44cc778",
            "created": "2026-04-22T22:46:35.212Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.205Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009)'s injector, inject.bin, changes the function pointer of the 'get main processor diagnostic data' TriStation command to the address of imain.bin so that it is executed prior to the normal handler. (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ccef2177-65ca-4126-bcd9-dd6ffb4c5e06",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--9f3df5ac-caa0-4189-9b9b-dcf2f6bbdc54",
            "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cd0ba68b-398b-4df1-b9bd-c1ea3ba0791f",
            "created": "2026-04-22T18:56:41.507Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.206Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cd18f19c-71dc-4b7b-929c-647804d4c614",
            "created": "2026-04-22T21:38:36.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.206Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cd1be463-233c-43c8-b03d-fa0d6bdd8427",
            "created": "2026-04-20T20:54:19.034Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:19.034Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cd645dbe-000a-43f9-86e6-622bb1ab1053",
            "created": "2026-04-23T00:41:02.190Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.206Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8",
            "created": "2024-03-28T14:27:34.578Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Triton-EENews-2017",
                    "description": "Blake Sobczak. (2019, March 7). The inside story of the world’s most dangerous malware. Retrieved March 25, 2024.",
                    "url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
                },
                {
                    "source_name": "FireEye TRITON 2018",
                    "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
                    "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:14.296Z",
            "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) utilized remote desktop protocol (RDP) jump boxes, poorly configured OT firewalls (Citation: Triton-EENews-2017), along with other traditional malware backdoors, to move into the ICS environment.(Citation: FireEye TRITON 2018)(Citation: Triton-EENews-2017)",
            "relationship_type": "uses",
            "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cdc5aea4-1aac-4e6b-86cd-39617629d96b",
            "created": "2023-09-27T14:53:03.323Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.139Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) issued unauthorized commands to substation breaks after gaining control of operator workstations and accessing a distribution management system (DMS) application. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ce3aad7e-1e15-40c7-916b-e25a647e9986",
            "created": "2023-09-29T16:31:36.462Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.207Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ce4d77f4-6b9f-435f-94ca-52bc4a90522b",
            "created": "2026-10-08T21:51:52.950Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:06:24.650Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed the IP addresses of internet-facing MicroLogix controllers, altering their network configuration settings outside normal operations.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ce5833db-4cd2-4034-ac97-8a02b14e0095",
            "created": "2025-09-29T19:03:17.501Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.207Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ce64ed04-f0ff-4897-b636-3177c9c5d9bb",
            "created": "2021-01-20T21:03:13.436Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
                    "description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
                    "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
                },
                {
                    "source_name": "Secureworks IRON VIKING ",
                    "description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
                    "url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:33.272Z",
            "description": "(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Secureworks IRON VIKING )",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cea316fe-8a9d-4e7c-ab2e-6134585bb69f",
            "created": "2023-09-28T19:49:56.464Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.208Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf125e14-158c-4bd2-9d86-61f349704c99",
            "created": "2026-09-26T04:58:28.802Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T04:58:28.802Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) were observed using secure shell ports TCP/22 and common industrial ports (TCP/44818, TCP&UDP/2222, TCP/102, and TCP/502). (Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf3d020e-5ca7-4867-a502-654e445cc45c",
            "created": "2024-03-27T19:55:40.243Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:11:05.595Z",
            "description": "During the [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034), [Sandworm Team](https://attack.mitre.org/groups/G0034) used the MicroSCADA SCIL-API to specify a set of SCADA instructions, including the sending of unauthorized commands to substation devices.(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "relationship_type": "uses",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf528b10-a4e6-49ed-8bc8-4629115d7752",
            "created": "2023-09-29T17:57:44.978Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf53ff89-3c31-4f8d-83a1-b74dce4c558d",
            "created": "2023-09-29T16:29:16.222Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf568097-5db4-4518-a786-87870dec04e0",
            "created": "2026-04-22T20:27:00.492Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf8a816c-30ee-4147-a48f-d797fb145a04",
            "created": "2023-09-29T17:43:10.828Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cf8acb4a-4918-4155-99a7-ee938278bbca",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--8ae936b6-b635-4104-bd11-81c18d90cf97",
            "target_ref": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cfaead3c-3db5-400f-bd15-dfbc57cf0185",
            "created": "2023-09-28T21:15:44.547Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cfb7dbe9-53ac-4b51-b031-3ae26ad1e1a5",
            "created": "2026-04-22T20:25:44.025Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.209Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cfc97955-3fda-4152-94c6-106f58a5579b",
            "created": "2026-04-20T20:54:16.106Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:16.106Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cfea8d23-2078-4741-bc12-7afa7a2dffa0",
            "created": "2023-09-28T21:09:41.659Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.210Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d015831c-a253-491d-9106-4ad0ccb43c3b",
            "created": "2025-09-24T18:23:51.180Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.210Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d02812b2-23c3-4dce-bf94-c6e464e86fab",
            "created": "2023-10-02T20:22:25.770Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.210Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d035ee22-59f0-4d4e-9420-d26f43533b06",
            "created": "2026-04-23T00:44:17.657Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:56.751Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c1645705-a26f-45b2-aa68-ff5c93dfc0f4",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d03785b3-9b51-45f2-aff5-029555c53826",
            "created": "2026-04-23T00:28:16.750Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.210Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d03de729-9235-4ceb-a1c0-935e2088020b",
            "created": "2023-09-28T21:29:12.533Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.210Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d0fb800d-f962-4e4f-a308-5e99374203c1",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--fe11c904-752f-40e2-b269-c53bbb29541a",
            "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d11ef23b-689d-4841-a225-bdaa202465c9",
            "created": "2026-10-07T20:29:05.934Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:29:05.934Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d1388bba-9869-4e3e-a6c9-430784ad924d",
            "created": "2023-09-27T14:59:13.988Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.153Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), operators were shut out of their equipment either through the denial of peripheral use or the degradation of equipment. Operators were therefore unable to recover from the incident through their traditional means. Much of the power was restored manually. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d1445579-245b-4698-a7df-365379e0d36d",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Research Whitepapers September 2018",
                    "description": "ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25 ",
                    "url": "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"
                },
                {
                    "source_name": "Intel",
                    "description": "Intel ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25  Intel Hardware-based Security Technologies for Intelligent Retail Devices Retrieved. 2020/09/25 ",
                    "url": "https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf"
                },
                {
                    "source_name": "N/A",
                    "description": "N/A   Trusted Platform Module (TPM) Summary Retrieved. 2020/09/25 ",
                    "url": "https://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.212Z",
            "description": "Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology.(Citation: N/A) Move system's root of trust to hardware to prevent tampering with the SPI flash memory.(Citation: ESET Research Whitepapers September 2018) Technologies such as Intel Boot Guard can assist with this.(Citation: Intel)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8ac1d6e1-b07f-476a-9732-84984ebc2405",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d16098fd-9b2d-479c-a25a-f970bce86f94",
            "created": "2026-09-26T02:59:06.328Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty-IOCONTROL",
                    "description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
                    "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
                },
                {
                    "source_name": "Dragos 2025 Year in Review",
                    "description": "Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
                },
                {
                    "source_name": "Armis-IOCONTROL",
                    "description": "Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.",
                    "url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-08T22:17:42.611Z",
            "description": "IOCONTROL has used DNS over HTTPS (DoH) via CloudFlare’s API to translate hostnames to IP addresses.(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)\n\n\n",
            "relationship_type": "uses",
            "source_ref": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
            "target_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d16e8909-d055-4174-aeb1-22c0613b2f73",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.212Z",
            "description": "Disable unnecessary legacy network protocols that may be used for AiTM if applicable.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d1bd77d4-9f1a-41ee-bf64-0aa7438e6896",
            "created": "2023-09-29T16:28:52.111Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.212Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d1d98f8c-aea2-4f06-9b0d-c543ed42c6a4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.212Z",
            "description": "Ensure that all SIS are segmented from operational networks to prevent them from being targeted by additional adversarial behavior.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--da44255d-85c5-492c-baf3-ee823d44f848",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d23fd724-563d-4f49-8bcd-09c653728cd3",
            "created": "2023-09-28T21:28:00.462Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.213Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d2985b8a-7a29-4b57-b2f1-cddd79fe4242",
            "created": "2023-09-28T19:53:20.304Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.213Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d2a434c7-4428-435e-ae6b-e54012f29606",
            "created": "2023-09-25T20:43:52.987Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.213Z",
            "description": "All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d2dc57eb-5be2-4f9c-a4f7-18d2085ff412",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Robert Falcone, Bryan Lee May 2016",
                    "description": "Robert Falcone, Bryan Lee 2016, May 26 The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor Retrieved. 2019/11/19 ",
                    "url": "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:35.867Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) communicated with its command and control using HTTP requests. (Citation: Robert Falcone, Bryan Lee May 2016)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d304ae90-33b1-4cfe-b60e-6c93780f4bf9",
            "created": "2026-09-26T03:55:17.193Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty-IOCONTROL",
                    "description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
                    "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:55:17.193Z",
            "description": "IOCONTROL has executed arbitrary commands using system calls as well as scripts with the UNIX Shell.(Citation: Claroty-IOCONTROL)",
            "relationship_type": "uses",
            "source_ref": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
            "target_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3266f04-3453-492d-b9ea-6fb9d0ce3999",
            "created": "2023-09-29T18:49:54.378Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.364Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3564f1f-8637-4878-a66a-3e8ea46f7a72",
            "created": "2023-09-28T19:38:27.199Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.704Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3717846-eaab-4fde-99f6-a972dec9323b",
            "created": "2024-03-27T19:43:45.213Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos-Sandworm-Ukraine-2022",
                    "description": "Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.",
                    "url": "https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/"
                },
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:11:05.637Z",
            "description": "(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022) ",
            "relationship_type": "attributed-to",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3a24d5e-ae6e-4427-a1db-ae87b7a2b6e4",
            "created": "2026-04-22T13:31:34.115Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "description": "Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3c94120-e6b5-4bd2-88f0-9c73f76b0104",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "description": "Ensure anti-virus solution can detect malicious files that allow user execution (e.g., Microsoft Office Macros, program installers).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3d4f469-9847-41ef-a478-5eaf6003d483",
            "created": "2023-10-02T20:23:00.405Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d3ec223b-9dca-4e5e-8d09-b69a04110eec",
            "created": "2025-09-29T19:07:38.953Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d40fab57-a843-45b9-a70d-6c795e1cc476",
            "created": "2026-04-22T21:41:08.012Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d45464ea-98b2-4f57-8f42-1cccc49e075f",
            "created": "2025-09-24T18:14:34.036Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d455330d-f190-4854-8087-4c2c37003b45",
            "created": "2023-09-29T17:39:29.897Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.215Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d462143c-69d1-44c9-b657-b64deb12eab8",
            "created": "2026-04-22T16:05:26.631Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.216Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d48894cb-457e-4a81-82b4-2d735aea5128",
            "created": "2023-09-28T19:50:56.496Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.103Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d4968f45-d06b-4843-8f72-6e08beb94cab",
            "created": "2017-05-31T21:33:27.070Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec Dragonfly",
                    "description": "Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.",
                    "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
                },
                {
                    "source_name": "Gigamon Berserk Bear October 2021",
                    "description": "Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.",
                    "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.701Z",
            "description": "(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
            "target_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d4a6d928-ac0c-4b27-a3bc-e42703b5859c",
            "created": "2025-09-29T19:02:23.617Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.216Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d4da5e90-7986-4c8a-bfb6-df4c0586ce87",
            "created": "2024-03-27T20:48:27.536Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Mandiant-Sandworm-Ukraine-2022",
                    "description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
                    "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:11:05.650Z",
            "description": "During the [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034), [Sandworm Team](https://attack.mitre.org/groups/G0034) used existing hypervisor access to map an ISO image named `a.iso` to a virtual machine running a SCADA server. The SCADA server’s operating system was configured to autorun CD-ROM images, and as a result, a malicious VBS script on the ISO image was automatically executed.(Citation: Mandiant-Sandworm-Ukraine-2022)",
            "relationship_type": "uses",
            "source_ref": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
            "target_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d4f64f95-42cd-46e6-8fcf-25ef0d868f5b",
            "created": "2026-04-23T00:25:42.814Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.216Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d50a3d89-c8fa-4c5d-813e-f4495d892d1a",
            "created": "2019-03-25T19:13:54.947Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.376Z",
            "description": "[WannaCry](https://attack.mitre.org/software/S0366) can move laterally through industrial networks by means of the SMB service. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d5238e56-6e41-44ed-a6f5-ebe49f5443d7",
            "created": "2026-10-07T21:14:38.956Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:14:38.956Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d5289c2e-e5c4-443d-94ec-ce9a44992065",
            "created": "2025-09-24T17:56:06.321Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.217Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d55057c5-988d-4f66-bfba-650c49259d01",
            "created": "2023-09-29T17:37:50.048Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.217Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d58d8b19-90bc-4a7f-840d-076be296ff20",
            "created": "2023-09-29T17:09:01.803Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.217Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d5b532fe-3df9-4f92-a0f0-9c92823cdb6a",
            "created": "2023-09-28T19:43:49.584Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.217Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d5e20226-108d-473c-b396-0fc10f11e129",
            "created": "2026-10-07T21:41:50.604Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:41:50.604Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d5e908f9-eea1-4e55-a406-f24c5dc74b2d",
            "created": "2023-09-29T17:38:17.313Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.716Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d611b750-95e5-4f73-8f16-38db0a34a2e0",
            "created": "2023-09-29T17:08:23.682Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.218Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d65646f0-f90c-4415-bbde-cce61f13898f",
            "created": "2026-04-22T22:46:53.310Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.218Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d67ae959-9014-4501-b963-42bee03a5e3b",
            "created": "2024-03-25T20:09:34.908Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jamie Tarabay and Katrina Manson December 2023",
                    "description": "Jamie Tarabay and Katrina Manson. (2023, December 22). Iranian-Linked Hacks Expose Failure to Safeguard US Water System. Retrieved March 25, 2024.",
                    "url": "https://www.bloomberg.com/news/articles/2023-12-22/iranian-linked-hacks-expose-failure-to-safeguard-us-water-system"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:17.871Z",
            "description": "During the [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031), the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) caused multiple businesses to halt operations in their industrial environments, impacting their typical business operations. These victims covered multiple sectors.(Citation: Jamie Tarabay and Katrina Manson December 2023)",
            "relationship_type": "uses",
            "source_ref": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d67feaac-73ac-47b1-91ec-f537105afc58",
            "created": "2026-04-22T17:51:33.089Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.218Z",
            "description": "When at rest, project files should be encrypted to prevent unauthorized changes.(Citation: National Institute of Standards and Technology April 2013)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d6a2a1a8-8f5b-4e94-8fce-8edd8a17627a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.219Z",
            "description": "When available utilize hardware and software root-of-trust to verify the authenticity of a system. This may be achieved through cryptographic means, such as digital signatures or hashes, of critical software and firmware throughout the supply chain.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d72458b4-b72b-4f0b-96da-eb3d9c6ef9a2",
            "created": "2026-04-22T20:39:30.233Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.219Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d72e7d01-56be-4fbd-8957-3384533ba83b",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.219Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) leverages a reconstructed TriStation protocol within its framework to trigger APIs related to program download, program allocation, and program changes. (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d775a6ed-4a60-41f4-ac06-da86c27cd1de",
            "created": "2023-09-29T18:48:41.176Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.219Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d7ab9f93-163e-4000-9573-674a7e4de44c",
            "created": "2026-04-22T20:26:01.557Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.220Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d7b07d40-fbdb-41e9-b610-57de10fa41e5",
            "created": "2023-09-28T20:29:50.745Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.220Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d7ea83fa-87c7-4d36-96d5-aee554504040",
            "created": "2017-05-31T21:33:27.074Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ESET Bad Rabbit",
                    "description": "M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.",
                    "url": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.220Z",
            "description": "Several transportation organizations in Ukraine have suffered from being infected by [Bad Rabbit](https://attack.mitre.org/software/S0606), resulting in some computers becoming encrypted, according to media reports. (Citation: ESET Bad Rabbit)",
            "relationship_type": "uses",
            "source_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d80c615e-addc-49c8-a2b9-991e24678d86",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--6d2ba563-0aa9-4f64-a14d-da62b694b495",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d80f9deb-ba2a-4a07-aa23-81c423cf4a18",
            "created": "2023-09-29T16:46:01.992Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.220Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d8354850-bd4c-4bd9-a585-b107f5f1398f",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017",
                    "description": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12 ",
                    "url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.220Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) has the capability to reprogram the SIS logic to allow unsafe conditions to persist or reprogram the SIS to allow an unsafe state  while using the DCS to create an unsafe state or hazard. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d854cc38-adf7-485d-96b5-70606f6cb87e",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "description": "Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in the [Filter Network Traffic](https://attack.mitre.org/mitigations/M0937) mitigation.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d8911566-f622-4a01-b765-514dbbfd8201",
            "created": "2022-09-28T20:27:01.345Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can deploy Tcpdump to sniff network traffic and collect PCAP files.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d89d9778-4695-4c97-bf6d-1d0fbabb41fa",
            "created": "2023-09-28T21:14:51.778Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d8f45959-e0fc-4b4f-a074-a3acea926300",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "description": "Consider the disabling of features such as AutoRun.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
            "target_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d8f95008-33c9-4572-9916-023d8de449b1",
            "created": "2023-09-29T18:04:16.785Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d90aeeb6-3686-483a-8403-6514ecfe1a50",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "ICS-CERT August 2018",
                    "description": "ICS-CERT 2018, August 22 Advisory (ICSA-14-178-01) Retrieved. 2019/04/01 ",
                    "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.221Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications. (Citation: ICS-CERT August 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d9165ecb-bc10-4189-a7e4-057bdf05bf3f",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.222Z",
            "description": "[BlackEnergy](https://attack.mitre.org/software/S0089) targeted energy sector organizations in a wide reaching email spearphishing campaign. Adversaries utilized malicious Microsoft Word documents attachments. (Citation: Booz Allen Hamilton)\n",
            "relationship_type": "uses",
            "source_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d96788b4-55dd-48df-bb9b-83b33ca24813",
            "created": "2023-09-28T19:55:22.376Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.222Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d99a28f4-6536-4d73-9241-497cda9a8878",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--1bae319f-03d8-49c9-8bb8-e4f27bb69a11",
            "target_ref": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d99e23f0-16ae-4391-a3e4-a38181114a22",
            "created": "2026-09-26T01:59:07.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:59:07.450Z",
            "description": "Restrict Python execution to approved interpreters, scripts, libraries, accounts, and paths. On engineering systems where Python is required, use positive allowlisting rather than disabling the interpreter.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d99fecbc-a7ea-4430-b933-afd239c4555b",
            "created": "2023-09-29T18:43:23.321Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.222Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d9a351b5-1d77-4f16-a191-1a8992c5bb5b",
            "created": "2025-09-24T17:57:31.366Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.222Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d9d6acfe-c905-41fd-9e29-8c3b047e4916",
            "created": "2026-09-25T18:32:37.528Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T16:40:38.025Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries executed PowerShell commands on the Human Machine Interface (HMI) to make configuration changes that enabled administrative shares and created a new firewall rule to enable traffic over port 445 as well as conducted network reconnaissance activities.(Citation: CERT Polska)\n\nDuring the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries executed PowerShell commands on the domain controller that collected and exfiltrated the SAM and SYSTEM registry hives and the Active Directory database (ntds.dit).(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d9de58a6-58fd-499c-ba7d-588239297179",
            "created": "2023-09-29T16:42:31.464Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d9fa7d68-a07c-4cf0-bb01-14e2c70c21d5",
            "created": "2023-09-28T19:51:11.687Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da144dd2-c949-4a7f-8c8d-0cb27c52196a",
            "created": "2023-09-29T16:42:53.226Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da246386-12c6-4d7e-adc2-f3148686d6c1",
            "created": "2025-09-29T22:06:02.769Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da38a045-d29a-4c08-9951-c8e520229584",
            "created": "2023-09-27T14:48:40.533Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.181Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) blocked reporting messages by using malicious firmware to render serial-to-ethernet converters inoperable. (Citation: Ukraine15 - EISAC - 201603)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da6aa4ab-039e-40fc-8188-8006ccd2ea8c",
            "created": "2026-04-22T13:27:55.225Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da771d72-c778-4c9a-acb4-01b5fc3d36c0",
            "created": "2023-09-29T18:06:57.332Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.223Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da7ee266-be41-4b80-a71b-7e067e6bdb5a",
            "created": "2026-09-26T01:52:11.789Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:52:11.789Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da987131-bf37-4730-9914-323879d2b5c3",
            "created": "2023-09-28T20:34:11.025Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.224Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dac96d76-b9b8-4278-9f5b-62f4992e2ac8",
            "created": "2023-09-28T19:44:22.801Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.224Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dae4ef38-bd41-45e0-b780-ea9d411386d3",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--e8b537e6-04eb-4168-a206-88cc041edf50",
            "target_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--db221f13-ffd3-49bb-bbe2-8f8a0023a5a0",
            "created": "2026-10-07T21:21:20.378Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:21:20.378Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--db5e5a2a-dc41-4f04-910e-ab4dfccd1e0d",
            "created": "2026-04-22T18:59:44.658Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.225Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--db6c3e5b-f1f5-4a3a-b391-5a973e58084b",
            "created": "2026-10-07T21:23:27.994Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:23:27.994Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dbcc492c-782e-4418-8373-dbc7a76498b0",
            "created": "2023-09-29T17:45:35.293Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.225Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dbdd9a97-81df-40b8-b72d-ac67d121b8b3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.225Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dc35c44a-a90c-48a1-8811-af2618216e42",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.226Z",
            "description": "Use strong multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials. Be aware of multi-factor authentication interception techniques for some implementations.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ddf3e568-f065-49e2-9106-42029a28ddbd",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dc4ea40d-059d-4952-a525-5f915c7f23ba",
            "created": "2026-09-25T18:34:17.564Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Robert Falcone, Bryan Lee May 2016",
                    "description": "Robert Falcone, Bryan Lee 2016, May 26 The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor Retrieved. 2019/11/19 ",
                    "url": "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T18:34:17.564Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.(Citation: Robert Falcone, Bryan Lee May 2016)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dc5736b5-b906-41e9-b772-53d92b1aa48c",
            "created": "2025-09-24T18:04:59.096Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.226Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dd164aa3-1bec-4d3b-afb4-25f0e3a29f9f",
            "created": "2026-04-20T20:58:41.108Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:41.108Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dd350208-e49c-412f-b249-f09d8203f1eb",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--3a772c6d-fda2-404a-86aa-85a0bdbb43e9",
            "target_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dda89758-9d0b-446d-b594-85acc7f9cb90",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.228Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dded2d68-35c7-42c4-af10-efe7731673e3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.228Z",
            "description": "All APIs on remote systems or local processes should require the authentication of users before executing any code or system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--de370506-01db-412f-a6fb-57c4014de788",
            "created": "2026-04-23T00:38:54.094Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.228Z",
            "description": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--de520a68-3ad7-4bd2-a4a6-2380e328e929",
            "created": "2026-10-07T17:52:49.636Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:52:49.636Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--a24f6d21-a614-46bd-9817-f55a576a05ea",
            "target_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--de6a1c7c-8d90-4f5c-8618-7c7ea9a2da89",
            "created": "2026-04-22T16:02:26.676Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.228Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--de973619-e66f-4cb8-92fc-0d5fe85214fa",
            "created": "2026-04-23T01:11:19.464Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.031Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used `arp` to conduct remote system discovery activities.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dead5325-7efe-4dcc-bf78-42b9190f74da",
            "created": "2023-09-29T16:46:40.272Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.229Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--deb83319-bc5a-4b9b-a44a-bd369b899601",
            "created": "2024-03-25T20:18:12.056Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.229Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--def57041-6bb4-453a-bf04-188b9e97a35d",
            "created": "2023-09-28T21:26:34.603Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.229Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df321d74-25d6-42da-80e8-3c9a291cb471",
            "created": "2023-09-28T19:57:41.602Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df67d728-289e-4d04-9635-d018c0764ce9",
            "created": "2026-04-22T21:36:02.911Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df6da4ec-cbe8-4f93-a41f-3726a9491938",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "description": "Statically defined ARP entries can prevent manipulation and sniffing of switched network traffic, as some AiTM techniques depend on sending spoofed ARP messages to manipulate network host's dynamic ARP tables.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df7b521e-4496-432f-a61d-3094d0c7bc23",
            "created": "2023-09-29T17:58:26.994Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.729Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df80e2b6-5672-4f26-a19c-a394f3731f24",
            "created": "2023-09-28T19:48:48.649Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--df9f5a5b-0662-4904-8e57-bc25c244a6da",
            "created": "2023-09-28T20:11:11.658Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dfb20521-91c2-4f55-b92a-dab959759b78",
            "created": "2023-09-29T18:03:38.874Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dfc355bd-ee2e-4c80-a61c-0ca700dbc006",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--105c127f-2777-452e-bf61-b0786ee13861",
            "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dfc6fb8e-87f4-4a50-a21e-1df2ad35d3c6",
            "created": "2025-09-29T19:03:53.406Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.740Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dfcfa2cf-6873-46a7-a924-68783378c15d",
            "created": "2026-04-22T13:54:19.768Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.230Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dfd0dc6c-33ad-44a4-9def-1d8e23e278fb",
            "created": "2022-04-15T22:05:32.209Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.730Z",
            "relationship_type": "revoked-by",
            "source_ref": "intrusion-set--76d59913-1d24-4992-a8ac-05a3eb093f71",
            "target_ref": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e00efbb9-4663-4a0a-8fbe-d7dcc4395fc9",
            "created": "2023-10-02T20:18:01.546Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.231Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0152ca1-4ad2-4dce-9231-cad70c802d62",
            "created": "2026-10-08T21:54:29.073Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Dragos Water Under Attack",
                    "description": "Michael Rothschild. (2026, August 13). Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open. Retrieved October 8, 2026.",
                    "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:09:49.940Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary temporarily shut down the well and water treatment plant, causing loss of cellular connectivity across multiple sites interrupting the service the plant provides leading operators to revert to manual operations.(Citation: Tenable Minnesota Water Utilities)(Citation: Dragos Water Under Attack)\n\nDuring the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary caused loss of water pressure and flooding at affected water and wastewater utilities.(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e04e99cd-cf77-45fa-b4e9-dda96488aacf",
            "created": "2026-10-07T20:11:40.440Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:11:40.440Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e060820a-5a37-4abe-b27e-e157f2d6fa27",
            "created": "2026-10-08T21:50:42.806Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:14:59.339Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary altered the control logic (e.g., project files) of internet-exposed PLCs, producing ladder logic discrepancies, changing how the affected controller interacted with its process, after gaining access through default credentials.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0613dac-bb51-482a-b005-f58cf7a69e7b",
            "created": "2026-04-22T22:47:42.854Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.231Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e08d8829-1861-45db-a724-00e8b15b6e3d",
            "created": "2026-10-07T21:46:28.706Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:46:28.706Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e09e253c-fd28-49ae-988e-1f80d769e8b8",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.231Z",
            "description": "Prevent the use of unsigned executables, such as installers and scripts.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0aee02c-b424-4781-be10-793d71594c31",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
                    "description": "Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ",
                    "url": "https://www.f-secure.com/weblog/archives/00002718.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.231Z",
            "description": "The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) RAT is distributed through a trojanized installer attached to emails. (Citation: Daavid Hentunen, Antti Tikkanen June 2014)",
            "relationship_type": "uses",
            "source_ref": "malware--083bb47b-02c8-4423-81a2-f9ef58572974",
            "target_ref": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0bdfd25-c995-416e-9140-3520390da809",
            "created": "2026-09-26T01:59:42.666Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T01:59:42.666Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--045550b2-8bb3-43ee-92fc-214f955fabdc",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0d101cc-1284-4e88-82d6-227fe5d19d8a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.232Z",
            "description": "Update software regularly by employing patch management for internal enterprise endpoints and servers.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0da1f92-82b1-4096-86c4-1aef58ca89fb",
            "created": "2023-03-10T20:08:40.601Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Marshall Abrams July 2008",
                    "description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
                    "url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:16.248Z",
            "description": "In the [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020), the adversary temporarily shut an investigator out of the network, preventing them from viewing the state of the system.(Citation: Marshall Abrams July 2008)",
            "relationship_type": "uses",
            "source_ref": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e0e525c1-2c94-45b9-999f-741d0b1a5c66",
            "created": "2026-10-07T21:23:59.116Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:23:59.116Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e100841e-fe9f-452f-8396-9aa635255efb",
            "created": "2026-04-22T21:37:58.480Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.232Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e1269074-37f4-460b-8a2a-cd26892d4f8e",
            "created": "2023-09-28T19:42:54.009Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.232Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e156609f-c30b-4bf5-8a1b-9689ba778a14",
            "created": "2023-03-31T17:44:45.164Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Crashoverride 2018",
                    "description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
                    "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T21:05:26.415Z",
            "description": "During the [2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025), [Sandworm Team](https://attack.mitre.org/groups/G0034) transferred executable files as .txt and then renamed them to .exe, likely to avoid detection through extension tracking.(Citation: Dragos Crashoverride 2018)",
            "relationship_type": "uses",
            "source_ref": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e1653814-74cd-4885-906f-b3af88452917",
            "created": "2026-04-23T00:06:22.758Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.232Z",
            "description": "Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e17c3b74-69d8-47b2-88d4-adcaf418ab74",
            "created": "2023-09-29T17:08:48.251Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.232Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e1f28ed0-ec35-4792-ae02-a2d003bd3df4",
            "created": "2023-09-28T20:09:07.381Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.233Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e257913e-40ba-4a05-ba97-0c3175c966b5",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                },
                {
                    "source_name": "Langer Stuxnet",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved December 7, 2020.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.233Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) manipulates the view of operators replaying process input and manipulating the I/O image to evade detection and inhibit protection functions. (Citation: Langer Stuxnet) (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e323dee4-a896-4a82-85f5-d51d311b0437",
            "created": "2021-04-12T18:49:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Max Heinemeyer February 2020",
                    "description": "Max Heinemeyer 2020, February 21 Post-mortem of a targeted Sodinokibi ransomware attack Retrieved. 2021/04/12 ",
                    "url": "https://www.darktrace.com/en/blog/post-mortem-of-a-targeted-sodinokibi-ransomware-attack/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.234Z",
            "description": "[REvil](https://attack.mitre.org/software/S0496) uses the SMB protocol to encrypt files located on remotely connected file shares. (Citation: Max Heinemeyer February 2020)",
            "relationship_type": "uses",
            "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e347c1e5-0c5b-42bb-b8d4-fafba4bcd319",
            "created": "2026-04-22T16:35:10.762Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.235Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e359049e-0a1f-4877-8114-ac40b8c8d4fd",
            "created": "2026-09-26T03:36:32.286Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:36:32.286Z",
            "description": "Use protocol-aware network controls to detect and, where operationally safe, prevent connections to unapproved brokers or malicious infrastructure and misuse of publish/subscribe protocol features for command-and-control.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
            "target_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e36e7e4d-fb9f-4396-bbc2-260dfc53cf8b",
            "created": "2026-04-20T20:54:18.551Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:54:18.551Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e3923fcf-5580-4c1e-bc55-33f67792cc00",
            "created": "2022-09-28T20:25:51.024Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos-Pipedream",
                    "description": "DRAGOS. (2022, April 13). Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
                },
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                },
                {
                    "source_name": "Brubaker-Incontroller",
                    "description": "Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.",
                    "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.235Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can wipe the memory of Omron PLCs and reset settings through the remote HTTP service.(Citation: Brubaker-Incontroller)(Citation: Dragos-Pipedream)(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e3b04152-0c90-41ff-a333-c5163fa9714f",
            "created": "2023-09-29T17:41:22.619Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.235Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e3f683d8-b15e-4134-948f-8f4bc535e86e",
            "created": "2026-10-07T21:44:41.012Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:44:41.012Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e41a04fe-a142-4294-a9f2-576214e1f985",
            "created": "2024-04-09T20:48:04.616Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.236Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e434db5d-f201-4411-825f-4a50e1e78c75",
            "created": "2023-09-29T17:06:20.834Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.236Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4850ba4-7933-4518-a9af-667cb99ff7f6",
            "created": "2026-04-22T20:27:19.955Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.054Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries stole sensitive operational information that was used to plan the attack on the operational technology systems.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4897cee-6e09-440d-89fe-a299c696bb92",
            "created": "2026-04-22T16:37:32.002Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.236Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e48987f0-bbe0-4b73-ba70-d5e660ef9ac8",
            "created": "2026-09-25T20:25:54.934Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:25:54.934Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e49e0138-4247-4f3e-a42c-f0dab2f6ffbc",
            "created": "2023-09-29T18:49:44.351Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.236Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e49fb083-b1aa-4ac9-a99e-7e9ea1542e32",
            "created": "2026-04-22T20:11:05.522Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.061Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries used `nslookup` and `ping` to conduct remote system discovery activities.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4bc29f2-87c8-491d-b51b-d6cede7c1972",
            "created": "2023-09-29T16:45:33.777Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.237Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4c62e59-d14e-4cbc-a4a9-4f64bd523d5a",
            "created": "2024-04-09T21:00:11.159Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.237Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4c87389-950e-45ab-b53a-3cafb21c08a3",
            "created": "2026-04-22T20:15:55.649Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.237Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e4e37e2e-c6fc-4a67-a1c5-b349b1cd5a79",
            "created": "2025-09-29T19:09:16.239Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.237Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e5124e09-c11a-4af0-b19d-8e67e88de924",
            "created": "2026-10-07T20:38:12.775Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:38:12.775Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e5590e10-2ba5-456e-a93c-8132239819a2",
            "created": "2026-10-07T21:47:06.870Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:47:06.870Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e56064d9-388d-45b3-99a9-4eeec2e681da",
            "created": "2026-04-22T22:42:50.619Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:58.207Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--feb80c7a-96cd-4300-b344-4d75b176c9cb",
            "target_ref": "attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e5afc447-a241-4773-9a8a-3d6fd205d926",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.238Z",
            "description": "Utilize exploit protection to prevent activities which may be exploited through malicious web sites.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--49363b74-d506-4342-bd63-320586ebadb9",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e5c66301-43ae-4587-ba10-cde207b66616",
            "created": "2026-10-07T20:09:08.000Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:11:06.518Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e5c9aacb-51e3-41d3-995d-9e6ed04a2454",
            "created": "2023-10-02T20:17:51.320Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.238Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e607bb66-e53f-4684-b3f1-36a997e27d01",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004",
                    "description": "A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY  IEC 61511 Retrieved. 2020/09/17 ",
                    "url": "https://www.icheme.org/media/9906/xviii-paper-23.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.238Z",
            "description": "Protection devices should have minimal digital components to prevent exposure to related adversarial techniques. Examples include interlocks, rupture disks, release valves, etc. (Citation: A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--8bc4a54e-810c-4600-8b6c-08fa8413a401",
            "target_ref": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e62235fe-0546-4755-ad01-fedce306ef89",
            "created": "2026-04-22T13:57:10.500Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                },
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.238Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.(Citation: Karen Scarfone; Paul Hoffman September 2009)(Citation: Keith Stouffer May 2015)(Citation: Department of Homeland Security September 2016)(Citation: Dwight Anderson 2014) ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e627461f-f2cc-427b-8896-72db160bca24",
            "created": "2026-04-22T21:42:46.708Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.238Z",
            "description": "Implement network allowlists to minimize network access to only authorized hosts.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e6be2fb4-3815-4e52-8dec-2aed1dc3b7cf",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.239Z",
            "description": "All field controllers should restrict the modification of parameter values to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism. They should also restrict online edits and enable write protection for parameters. \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e6c2b27e-a549-4acc-946a-c60401a2a771",
            "created": "2026-10-07T20:07:18.139Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:07:18.139Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e6e0ef82-2cb6-43fe-8f4a-b9e4d5a57b13",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.239Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e701bb90-1a4a-418c-a48b-183246f52dea",
            "created": "2026-10-07T21:54:17.166Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:54:17.166Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e70972b7-6bd0-48f9-83ee-b7a472a3e43e",
            "created": "2026-10-07T21:23:11.786Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:23:11.786Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e70d04d1-51e3-4d43-b3dd-111daeea14f9",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.239Z",
            "description": "The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e7564f70-9f10-4135-9803-842cd3d2a02f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.240Z",
            "description": "Patch the BIOS and EFI as necessary.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--97f33c84-8508-45b9-8a1d-cac921828c9e",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e75f88e6-1ffb-467b-b488-46e91cb3e1e9",
            "created": "2023-09-28T19:42:16.270Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.240Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e767c178-e4b2-490a-b544-bb1b2d6c7de4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.240Z",
            "description": "Application isolation will limit the other processes and system features an exploited target can access. Examples of built in features are software restriction policies, AppLocker for Windows, and SELinux or AppArmor for Linux.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e79825fb-3bd0-41e7-9bdd-257cd3ab44a2",
            "created": "2023-09-29T16:45:20.769Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.240Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e7b44697-7269-427c-a825-3c41ec6dc385",
            "created": "2026-04-20T20:58:43.015Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:43.015Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--8535b71e-3c12-4258-a4ab-40257a1becc4",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e7c3b02a-a932-4561-b812-5cfadd7f9b2f",
            "created": "2024-11-20T23:25:47.710Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.568Z",
            "description": "During [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041), the adversary initiated a firmware downgrade on victim devices to a version lacking monitoring.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e7eca1f8-1c88-4d99-996c-b93e0c66f063",
            "created": "2025-09-29T19:57:33.616Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.241Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e8076aaa-25e1-48cf-afcd-2365a67a8029",
            "created": "2026-04-22T22:51:11.523Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.241Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e83a79df-2555-4b2f-9ade-b9ed2689ae42",
            "created": "2023-09-29T16:39:41.736Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.241Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e852e64c-b5e0-4e7f-a189-bbc7aa7932c7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "M. Rentschler and H. Heine",
                    "description": "M. Rentschler and H. Heine   The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
                    "url": "https://ieeexplore.ieee.org/document/6505877"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.241Z",
            "description": "Hot-standbys in diverse locations can ensure continued operations if the primarily system are compromised or unavailable. At the network layer, protocols such as the Parallel Redundancy Protocol can be used to simultaneously use redundant and diverse communication over a local network. (Citation: M. Rentschler and H. Heine)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
            "target_ref": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e8a72417-2ff1-4bb7-93c2-17fa0c274d3d",
            "created": "2026-04-22T19:50:26.088Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.096Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries gained initial access by compromising Fortinet edge devices. (Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e8af0b34-4a67-4966-a34a-c4d1b346ea15",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.242Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e8eaac2d-a4bf-408f-b24f-14471db7059b",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.242Z",
            "description": "Minimize permissions and access for service accounts to limit the information that may be impacted by malicious users or software. (Citation: National Institute of Standards and Technology April 2013)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e8ef9bb9-1335-4418-b788-f8220dbbe4c8",
            "created": "2023-09-28T19:50:30.312Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.242Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e904e3ea-3488-4cb8-b21a-fdc370436b53",
            "created": "2026-10-07T20:08:52.480Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:08:52.480Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e915e12c-3d0c-4f60-b119-9414940abb0b",
            "created": "2023-09-28T20:08:27.145Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.242Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e95fe824-4df1-49a2-abf7-5d76fb47ef42",
            "created": "2023-09-28T19:45:18.672Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.243Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e98892d6-e036-4140-adbb-2932dba51a19",
            "created": "2023-09-28T20:08:09.519Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.243Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e9f5096e-b9fc-459a-a303-88763b1269cc",
            "created": "2020-05-14T14:41:42.975Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FireEye FIN6 Apr 2019",
                    "description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
                    "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:31.107Z",
            "description": "(Citation: FireEye FIN6 Apr 2019)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
            "target_ref": "malware--a020a61c-423f-4195-8c46-ba1d21abba37",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ea1ba63b-d0e1-4d1b-a098-72ce2c44a44a",
            "created": "2026-04-22T13:50:28.914Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ea211d90-b379-446f-bc5e-ae7befe5a6ff",
            "created": "2025-09-29T22:04:53.274Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ea38b054-5552-4287-b3da-c4ad7ff61e55",
            "created": "2023-09-28T20:04:32.626Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ea50253a-3220-458b-b810-ad032f2b182f",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                },
                {
                    "source_name": "ICS-CERT December 2018",
                    "description": "ICS-CERT 2018, December 18 Advisory (ICSA-18-107-02) - Schneider Electric Triconex Tricon (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02"
                },
                {
                    "source_name": "Schneider Electric January 2018",
                    "description": "Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 ",
                    "url": "https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s"
                },
                {
                    "source_name": "The Office of Nuclear Reactor Regulation",
                    "description": "The Office of Nuclear Reactor Regulation Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14  Triconex Topical Report 7286-545-1 Retrieved. 2018/05/30 ",
                    "url": "https://www.nrc.gov/docs/ML1209/ML120900890.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) disables a firmware RAM/ROM consistency check after injects a payload (imain.bin) into the firmware memory region. (Citation: DHS CISA February 2019) (Citation: ICS-CERT December 2018) (Citation: Schneider Electric January 2018) Triconex systems include continuous means of detection including checksums for firmware and program integrity, memory and memory reference integrity, and configuration. (Citation: The Office of Nuclear Reactor Regulation)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ea817c7a-9424-4204-90a5-6f8fb86037be",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "description": "Configure features related to account use like login attempt lockouts, specific login times, and password strength requirements as examples. Consider these features as they relate to assets which may impact safety and availability. (Citation: Keith Stouffer May 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--86b455f2-fb63-4043-93a8-32a3a7703a02",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eaa0b30e-1dea-4dad-9a1e-33da933a8158",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.244Z",
            "description": "Devices should verify that firmware has been properly signed by the vendor before allowing installation.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eac550b4-3bd2-4309-8b37-b797dd0bd8a7",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eadb4ca5-ee99-4169-a926-95b1ff82e960",
            "created": "2023-09-28T20:28:52.768Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eae674f9-10a2-41e6-9cd3-205af8e69d53",
            "created": "2023-09-28T20:05:15.314Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eaeb3c8d-9d91-4eb0-8049-5cb99e141026",
            "created": "2021-10-08T15:25:32.143Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "description": "[Stuxnet](https://attack.mitre.org/software/S0603) executes malicious SQL commands in the WinCC database server to propagate to remote systems. The malicious SQL commands include xp_cmdshell, sp_dumpdbilog, and sp_addextendedproc. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb171086-88e1-4f24-bd7e-c3f8b3c3283b",
            "created": "2023-09-28T19:44:09.311Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb1e05ef-58df-4c6d-acd7-5cc63ff7f44f",
            "created": "2021-10-08T15:42:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos Inc. June 2017",
                    "description": "Dragos Inc. 2017, June 13 Industroyer - Dragos - 201706: Analysis of the Threat to Electic Grid Operations Retrieved. 2017/09/18 ",
                    "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.114Z",
            "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) establishes an internal proxy prior to the installation of backdoors within the network. (Citation: Dragos Inc. June 2017)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb5310c6-7500-4b16-8ca7-6678c6232001",
            "created": "2023-09-29T19:36:38.824Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb54882a-57a0-477f-8a2c-4a18c8d463c7",
            "created": "2025-09-29T22:05:16.999Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb65b30e-53b1-4c27-8841-ee7daec9c33b",
            "created": "2026-04-22T16:36:35.229Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.245Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb7f4859-4173-42e5-811c-b3df217b7d72",
            "created": "2026-09-26T03:35:17.466Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty-IOCONTROL",
                    "description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
                    "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
                },
                {
                    "source_name": "Dragos 2025 Year in Review",
                    "description": "Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.",
                    "url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
                },
                {
                    "source_name": "Armis-IOCONTROL",
                    "description": "Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.",
                    "url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T03:51:49.057Z",
            "description": "IOCONTROL connects to C2 servers using the MQTT protocol over port 1883 and 8883 (encrypted via SSL/TLS). The command-and-control servers are resolved using DNS-over-HTTPS (DoH).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)",
            "relationship_type": "uses",
            "source_ref": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
            "target_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eba478bb-7b76-4889-b82c-eda10826ffcb",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.246Z",
            "description": "Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a",
            "target_ref": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ebc34374-2dee-4dc1-b0b7-f31ae94dab11",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.246Z",
            "description": "Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ebc9f35c-6f95-4bc0-b8b3-f9b515690fa0",
            "created": "2023-09-29T17:09:37.977Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.246Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ec105f62-2552-41fa-8b07-619dc1bf9b19",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.246Z",
            "description": "Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ec16db2c-3265-4e0a-88d3-947e198c0a64",
            "created": "2026-04-22T20:27:21.792Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.246Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ec468947-8385-443e-8a1e-fbdebc46df8d",
            "created": "2026-04-22T18:55:48.001Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.247Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ecaf20c0-d881-45b4-98f2-a456e07d3643",
            "created": "2023-09-28T21:25:48.379Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.247Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eccbcd3d-ea6e-4e9d-aa15-7b6e0909b6e0",
            "created": "2026-04-22T13:56:15.092Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.247Z",
            "description": "Perform inline allowlisting of automation protocol commands to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid messages.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ecf39e19-439f-4e9a-97c2-673ce4eb0a1a",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "National Institute of Standards and Technology April 2013",
                    "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.247Z",
            "description": "Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage  (Citation: National Institute of Standards and Technology April 2013). Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ed095993-bc85-431e-9621-437143f16d44",
            "created": "2023-09-29T17:44:09.285Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.247Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ed3ce006-cf41-46f6-bd86-054314c130dc",
            "created": "2023-09-28T21:15:57.120Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.248Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ed3ef546-566a-46c7-918e-7bfa10d05991",
            "created": "2023-09-29T17:06:47.370Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.248Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ed66e087-8877-4146-a16a-44cfd144a3d8",
            "created": "2023-09-29T17:07:00.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.248Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--edaa6f5c-1b59-4ecb-a20f-716a61cdaccb",
            "created": "2023-09-29T16:39:29.206Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.248Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--edb0495d-5faf-40be-92e2-fcf0c0b25157",
            "created": "2026-04-22T21:37:30.373Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--edccbe1f-a07a-405e-9b9a-b247ce3dcc9b",
            "created": "2023-09-29T17:58:54.996Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ede2b798-2f39-419e-a7d3-8f0c733af4c1",
            "created": "2023-09-28T21:12:00.004Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ede5f716-52cd-4833-b092-5938262cd20b",
            "created": "2025-09-29T19:08:08.900Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--edf73653-b2d7-422f-b433-b6a428ff12d4",
            "created": "2017-05-31T21:33:27.074Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov October 2017",
                    "description": "Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov 2017, October 27 Bad Rabbit Ransomware Retrieved. 2019/10/27 ",
                    "url": "https://securelist.com/bad-rabbit-ransomware/82851/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) is disguised as an Adobe Flash installer. When the file is opened it starts locking the infected computer. (Citation: Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov October 2017)",
            "relationship_type": "uses",
            "source_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ee09658b-e384-4693-9318-b1e5d4a2e78a",
            "created": "2026-04-22T19:55:57.376Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.112Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries gained initial access to the operational technology via the compromised Fortinet edge devices, and used used SSH, RDP, and SMB/Windows Admin Shares to connect to remote systems and execute commands.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ee2fdebd-1587-4e53-a7d7-c15fcc88879d",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "description": "[BlackEnergy](https://attack.mitre.org/software/S0089) utilizes valid user and administrator credentials, in addition to creating new administrator accounts to maintain presence. (Citation: Booz Allen Hamilton)\n",
            "relationship_type": "uses",
            "source_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ee538956-6abf-4884-bbfa-16839f6c7d63",
            "created": "2025-09-29T19:03:09.092Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.249Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ee72cc27-2e78-47c4-8786-1351f9bcee97",
            "created": "2023-09-28T20:05:33.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.754Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ee89466e-0655-4217-844d-fb8ea4f76247",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "description": "Filter for protocols and payloads associated with firmware activation or updating activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eeb2a16d-5a4c-4d58-b4ed-c21320b5c569",
            "created": "2026-10-07T17:39:31.478Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T17:39:31.478Z",
            "relationship_type": "subtechnique-of",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eebae2f3-aaa1-4410-8b75-db5bdac1d4d6",
            "created": "2023-09-28T20:04:07.868Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eecca3e7-4db5-40d4-b04c-13f84701acb3",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security October 2009",
                    "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
            "target_ref": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eed98f8e-3eb9-4238-9acf-c2a0be136e87",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "description": "Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eeeaa0d4-0ca0-468e-ae13-43ab7aba61b4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                },
                {
                    "source_name": "Schweitzer Engineering Laboratories August 2015",
                    "description": "Schweitzer Engineering Laboratories 2015, August Understanding When to Use LDAP or RADIUS for Centralized Authentication Retrieved. 2020/09/25 ",
                    "url": "https://cdn.selinc.com/assets/Literature/Publications/Application%20Notes/AN2015-08_20150817.pdf?"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "description": "Consider configuration and use of a network-wide authentication service such as Active Directory, LDAP, or RADIUS capabilities which can be found in ICS devices. (Citation: Keith Stouffer May 2015) (Citation: Schweitzer Engineering Laboratories August 2015)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--2f0160b7-e982-49d7-9612-f19b810f1722",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eeeb83cb-0a8a-412b-aae2-aede7c43d8e8",
            "created": "2023-09-28T21:11:45.241Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eeeff03f-7436-4f76-8591-42075e6647d4",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.250Z",
            "description": "All field controllers should restrict operating mode changes to only required authenticated users (e.g., engineers, field technicians), preferably through implementing a role-based access mechanism. Further, physical mechanisms (e.g., keys) can also be used to limit unauthorized operating mode changes.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ef60735b-c64b-465c-9e5f-46a4d3a49fb3",
            "created": "2023-09-28T19:54:48.577Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.251Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ef615d62-fe85-4740-9c5d-5dddff9b5693",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Symantec Security Response July 2014",
                    "description": "Symantec Security Response 2014, July 7 Dragonfly: Cyberespionage Attacks Against Energy Suppliers Retrieved. 2016/04/08 ",
                    "url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers#:~:text=The%20attackers%2C%20known%20to%20Symantec,supply%20in%20the%20affected%20countries."
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.768Z",
            "description": "[Dragonfly](https://attack.mitre.org/groups/G0035) trojanized legitimate ICS equipment providers software packages available for download on their websites.(Citation: Symantec Security Response July 2014)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
            "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ef91b940-b3ea-4403-ba03-c71b8dcc8763",
            "created": "2026-10-08T21:33:02.119Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "FBI Water and Wastewater",
                    "description": "FBI Press Office. (2026, July 30). Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions. Retrieved October 8, 2026.",
                    "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
                },
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                },
                {
                    "source_name": "Forescout Water Systems Attack",
                    "description": "Sai Molige. (2026, August 5). OT Security Analysis: Exposed Devices Attacked in US Water Systems. Retrieved October 8, 2026.",
                    "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T00:18:32.638Z",
            "description": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary located internet-exposed PLCs (e.g., Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, etc.) at water and wastewater utilities, including cellular-connected water towers and sewer lift stations, and logged in to them directly.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater)",
            "relationship_type": "uses",
            "source_ref": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
            "target_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--efb80069-e4be-4055-bd34-06d1376b4601",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "McCarthy, J et al. July 2018",
                    "description": "McCarthy, J et al. 2018, July NIST SP 1800-2 Identity and Access Management for Electric Utilities Retrieved. 2020/09/17 ",
                    "url": "https://doi.org/10.6028/NIST.SP.1800-2"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.251Z",
            "description": "Access Management technologies can be used to enforce authorization policies and decisions, especially when existing field devices do not provide capabilities to support user identification and authentication. (Citation: McCarthy, J et al. July 2018) These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--efc4eb1c-f254-41a5-976c-31a39f3b35f6",
            "created": "2026-04-22T22:48:50.957Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.251Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--efe09c77-8ba8-4735-b1c9-5c9c01a67320",
            "created": "2026-09-26T05:10:12.058Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:10:12.058Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used manufacturers’ commercial PLC programming software to modify their victim’s running PLC program logic. These include Rockwell Automation’s [Studio Logix 5000 Designer](https://attack.mitre.org/software/S9054), Schneider Electric’s [EcoStruxure Control Expert](https://attack.mitre.org/software/S9056), and Siemens’ [Totally Integrated Automation (TIA) Portal](https://attack.mitre.org/software/S9055).(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--efece3a8-02ba-45da-828e-383d31631c62",
            "created": "2026-04-23T00:02:13.794Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.251Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77015a55-eef8-4f71-a071-b152f82ec1ef",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eff95bb0-9681-47a6-a83d-efeb39328217",
            "created": "2026-04-22T18:59:27.057Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--efface85-ce65-400f-8632-cb188cc08bcf",
            "created": "2025-09-29T19:11:45.227Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f043ed4b-f304-44c4-8bf5-5a96ffeb97cd",
            "created": "2026-04-22T20:40:50.871Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f05a2592-00f9-4f1f-ba55-395af5444b96",
            "created": "2023-09-29T17:42:29.179Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f08d487a-7837-48f9-9301-fe0f9f144c92",
            "created": "2023-09-28T20:31:04.691Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f0b2255d-2fa4-4b2a-a16b-77061243176e",
            "created": "2026-10-07T20:30:11.518Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:30:11.518Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f0c81c9f-2fb7-4e7d-98ed-c75e3be7d962",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "description": "When the peripheral output is written to, sequence C intercepts the output and ensures it is not written to the process image output. The output is the instructions the PLC sends to a device to change its operating behavior. By intercepting the peripheral output, [Stuxnet](https://attack.mitre.org/software/S0603) prevents an operator from noticing unauthorized commands sent to the peripheral. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f0c8a954-c1a0-453a-9c1d-484305abdab2",
            "created": "2021-04-12T18:59:17.429Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "description": "Filter application-layer protocol messages for remote services to block any unauthorized activity.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f0d4d23c-2c8c-4731-9b81-7c86fed25b5d",
            "created": "2023-09-29T18:45:34.258Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.252Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f130282b-f681-455f-966b-55829842be92",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Langer Stuxnet",
                    "description": "Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved December 7, 2020.",
                    "url": "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.253Z",
            "description": "One of [Stuxnet](https://attack.mitre.org/software/S0603)'s rootkits is contained entirely in the fake s7otbxdx.dll. In order to continue existing undetected on the PLC it needs to account for at least the following situations: read requests for its own malicious code blocks, read requests for infected blocks (OB1, OB35, DP_RECV), and write requests that could overwrite Stuxnets own code. Stuxnet contains code to monitor and intercept these types of requests. The rootkit modifies these requests so that Stuxnets PLC code is not discovered or damaged. (Citation: Langer Stuxnet)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f13dac1a-090b-40c6-9093-eb4abe0deba8",
            "created": "2023-09-28T21:24:22.815Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.253Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f14d1558-79b9-4fe4-8329-d26b19ef4ef8",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--3ea60ac7-87a3-4033-9089-258941d8388a",
            "target_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f15f24d2-e581-46ce-83e4-a924f572aae6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.253Z",
            "description": "Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f1745073-e18e-4d62-b439-1afb1ec472c9",
            "created": "2026-04-22T13:28:16.417Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.253Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f1bafa9d-986b-4d5c-b4c1-54aa3a7c4b91",
            "created": "2026-10-07T20:28:43.865Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:28:43.865Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f1c35b0c-c465-4f20-801a-b9b1fb088d94",
            "created": "2026-04-22T18:58:07.201Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.254Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f1edb034-6dc6-4d6c-8f75-e2cd12213704",
            "created": "2023-09-29T17:07:38.219Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.254Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f20d8eed-b517-4297-b32a-9a5e0845de9f",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.254Z",
            "description": "All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
            "target_ref": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f25c2744-e08f-4ea2-83c3-46a517ba4f4d",
            "created": "2025-09-29T19:09:04.156Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.254Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f29ecf69-1753-44bb-9b80-1025f49cadda",
            "created": "2017-12-14T16:46:06.044Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
                    "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
                    "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.255Z",
            "description": "DP_RECV is the name of a standard function block used by network coprocessors. It is used to receive network frames on the Profibus  a standard industrial network bus used for distributed I/O. The original block is copied to FC1869, and then replaced by a malicious block. Each time the function is used to receive a packet, the malicious [Stuxnet](https://attack.mitre.org/software/S0603) block takes control: it will call the original DP_RECV in FC1869 and then perform postprocessing on the packet data. The replaced DP_RECV block (later on referred to as the DP_RECV monitor) is meant to monitor data sent by the frequency converter drives to the 315-2 CPU via CP 342-5 Profibus communication modules. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
            "relationship_type": "uses",
            "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
            "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f2a0fb2a-3630-49eb-912b-5ee04c8ad281",
            "created": "2026-10-07T21:55:56.264Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:55:56.264Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f3178f64-d0e9-4cd0-84a4-0b28c0fde4bc",
            "created": "2026-04-22T16:41:35.915Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.255Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f347b4fe-d829-427d-851a-fff3393441db",
            "created": "2021-04-12T07:57:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik August 2019",
                    "description": "Joe Slowik 2019, August 15 CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack Retrieved. 2019/10/22 ",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.256Z",
            "description": "[Industroyer](https://attack.mitre.org/software/S0604) contained a module which leveraged a vulnerability in the Siemens SIPROTEC relays (CVE-2015-5374) to create a Denial of Service against automated protective relays. (Citation: Joe Slowik August 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
            "target_ref": "attack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f353e8ec-0766-4fbd-86b7-9ea06b52958b",
            "created": "2023-09-28T21:23:51.038Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.256Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f3b158ac-205e-483c-9b18-c4725ce24411",
            "created": "2026-10-09T15:57:40.558Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-09T15:58:19.596Z",
            "description": "Prevent unauthorized installation of Python interpreters and packages on ICS assets.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--945271ef-52cd-4a2c-a4cd-09edda7ffbab",
            "target_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f3b3bc3c-8259-44f2-95f7-3f6d81714bcb",
            "created": "2026-09-25T19:14:00.633Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos October 2018",
                    "description": "Dragos 2018, October 12 Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE Retrieved. 2019/10/14 ",
                    "url": "https://dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T19:14:00.633Z",
            "description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. (Citation: Dragos October 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
            "target_ref": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f3dbd66f-cfdb-488e-924f-a5cdc27d3a11",
            "created": "2026-04-22T21:40:49.547Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.256Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f3fab39f-864a-458a-b7dd-9ed38cfaa0e1",
            "created": "2026-04-22T13:54:59.989Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f40cc6f5-111c-418f-aa84-50d920fa6c48",
            "created": "2021-04-13T12:08:26.506Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "description": "Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--d48b79b2-076d-483e-949c-0d38aa347499",
            "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f448969e-217d-4946-bede-6c85dc1b123f",
            "created": "2025-09-29T19:48:41.376Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f45c2df8-30e7-45d0-8067-7b2870767574",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f497fd3e-8f05-4db2-97cc-48a8d35a8827",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "description": "Develop and publish policies that define acceptable information to be stored in repositories.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--dc61c280-c29d-44e5-a960-c0dd1623d2ba",
            "target_ref": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f4b94abb-3b81-4c92-8bd1-0fed105ece14",
            "created": "2023-09-28T19:37:35.485Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.257Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f4cae3bb-a699-43a6-9dae-fd3acac9551e",
            "created": "2025-09-24T18:19:38.546Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.258Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f531e763-3550-40ba-a6a1-81e208ca12c6",
            "created": "2023-09-29T16:41:06.217Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.258Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f5337891-61a3-4f24-a00a-8064a7ab4447",
            "created": "2025-09-29T19:05:22.195Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.258Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f5621ad9-c905-42e3-b59b-e0ae7b9051c7",
            "created": "2023-09-28T21:26:23.361Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.258Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f584a257-c22a-434b-aa2d-6220987821ab",
            "created": "2021-10-13T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Jos Wetzels January 2018",
                    "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
                    "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.258Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) can communicate with the implant utilizing the TriStation 'get main processor diagnostic data' command and looks for a specifically crafted packet body from which it extracts a command value and its arguments. (Citation: Jos Wetzels January 2018)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f5a50866-7b00-4e7c-936e-80c930d4f647",
            "created": "2026-10-07T21:21:31.153Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:21:31.153Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f5c91d82-5f7c-4e40-a85a-4f1909ae5545",
            "created": "2023-09-29T18:44:50.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.259Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f5e4f154-cb4a-4531-b63b-c55de7e3fcbb",
            "created": "2026-10-07T21:53:43.786Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:53:43.786Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f61944a4-fef5-4989-bc3d-68f86e65d7d4",
            "created": "2023-09-29T17:04:55.720Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.125Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6320c84-adfe-4a26-b33c-2b29ebd1337f",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c4777f1a-1481-4e8a-a3f4-0da57418c808",
            "target_ref": "attack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f65823c1-211b-40bf-a622-407bb511cb3d",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "DHS CISA February 2019",
                    "description": "DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ",
                    "url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.260Z",
            "description": "[Triton](https://attack.mitre.org/software/S1009) is able to read, write and execute code in memory on the safety controller at an arbitrary address within the devices firmware region. This allows the malware to make changes to the running firmware in memory and  modify how the device operates. (Citation: DHS CISA February 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
            "target_ref": "attack-pattern--68a9324d-a524-4766-a899-a026f68a33df",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f65a8ce8-90fa-4d92-a0dc-3ee544c541fe",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos",
                    "description": "Dragos   Chrysene Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/resource/chrysene/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:36.003Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) utilized stolen credentials to gain access to victim machines.(Citation: Dragos)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f65fa052-5ad0-4fc3-b579-ee33d1225659",
            "created": "2023-09-28T19:55:58.229Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.260Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6794183-bbc5-4c36-a597-fd49d4957c2b",
            "created": "2026-04-20T20:58:51.348Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-20T20:58:51.348Z",
            "relationship_type": "revoked-by",
            "source_ref": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60",
            "target_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f67a26e8-4951-40e7-8016-cd066f39b75e",
            "created": "2026-10-07T21:23:00.753Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:23:00.753Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f691dde5-bb2d-411b-a381-b33e0ab673d6",
            "created": "2023-09-28T20:12:09.661Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.260Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6bc7a24-c3e5-465c-ad71-52087cbff920",
            "created": "2025-09-29T19:12:16.231Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.260Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6e405c4-77e2-4bf3-8313-279aea9f0025",
            "created": "2026-04-22T16:41:01.640Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.260Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6f3d4ae-f58a-45bb-8c1e-712ac8c2073a",
            "created": "2026-10-07T21:55:05.985Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:55:05.985Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f6ff74c2-d088-4252-a8e0-189574863765",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "description": "Communication authenticity will ensure that any messages tampered with through AiTM can be detected, but cannot prevent eavesdropping on these. In addition, providing communication authenticity around various discovery protocols, such as DNS, can be used to prevent various AiTM procedures.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f703f8b2-b6b9-41f3-a551-6bb3647c45cc",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "description": "Use file system access controls to protect system and application folders.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f710e99a-dfe9-4b2b-8b1b-97ab1c9d65f3",
            "created": "2026-04-22T17:50:53.396Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "description": "Review the integrity of project files to verify they have not been modified by adversary behavior. Verify a cryptographic hash for the file with a known trusted version, or look for other indicators of modification (e.g., timestamps).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f7215c1f-7bd7-41bd-8466-76caac225c7c",
            "created": "2023-09-29T16:45:42.977Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f72a7a30-bab4-445b-b226-d5c3cd1a5846",
            "created": "2023-09-29T18:47:39.450Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f76dd26b-2aa3-4fc3-bdef-ddd0632d851b",
            "created": "2026-04-22T13:30:44.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
            "target_ref": "attack-pattern--338f4364-2269-4f70-9079-b20384b16628",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f780259e-b2e6-4a65-ae54-1e6bb3e9e8dd",
            "created": "2026-10-07T21:14:49.409Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:14:49.409Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f79d44ae-f971-484a-973b-e0cab972681d",
            "created": "2025-09-29T19:52:32.636Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.261Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f7a466c2-acdf-49b1-9906-41388f7a5238",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.262Z",
            "description": "Devices should authenticate all messages between master and outstation assets.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f7c5bd1b-c596-41b2-b415-2bf5179667df",
            "created": "2023-09-27T14:58:21.360Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Booz Allen Hamilton",
                    "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
                    "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
                },
                {
                    "source_name": "Ukraine15 - EISAC - 201603",
                    "description": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.",
                    "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-08-04T20:48:45.205Z",
            "description": "During the [2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028), [Sandworm Team](https://attack.mitre.org/groups/G0034) opened the breakers at the infected sites, shutting the power off for thousands of businesses and households for around 6 hours. (Citation: Ukraine15 - EISAC - 201603)(Citation: Booz Allen Hamilton)",
            "relationship_type": "uses",
            "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f7c641d2-3528-4b4a-9612-85827eb0fff8",
            "created": "2024-11-20T23:29:22.542Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Dragos FROSTYGOOP 2024",
                    "description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
                    "url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:13.585Z",
            "description": "During [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041), the adversary modified victim control system parameters resulting in the loss of heating services to impacted district heating customers.(Citation: Dragos FROSTYGOOP 2024)",
            "relationship_type": "uses",
            "source_ref": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
            "target_ref": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f7d672f6-993b-4036-961d-f6e22e94446c",
            "created": "2024-04-09T20:48:30.734Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.262Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f82c15ca-be3c-40f8-933b-6c8fee799ebd",
            "created": "2026-10-07T20:28:33.529Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:28:33.529Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f8318ac4-8ed0-478d-be87-faa2c9d8a740",
            "created": "2018-10-17T00:14:20.652Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Eduard Kovacs May 2018",
                    "description": "Eduard Kovacs 2018, May 21 Group linked to Shamoon attacks targeting ICS networks in Middle East and UK Retrieved September 12, 2024.",
                    "url": "https://web.archive.org/web/20220120001230/https://www.cyberviser.com/2018/05/group-linked-to-shamoon-attacks-targeting-ics-networks-in-middle-east-and-uk/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:36.011Z",
            "description": "[OilRig](https://attack.mitre.org/groups/G0049) has been seen utilizing watering hole attacks to collect credentials which could be used to gain access into ICS networks. (Citation: Eduard Kovacs May 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f8456c9b-a4a5-4f13-94e3-54c787b21089",
            "created": "2023-09-28T20:16:40.519Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.136Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f8578dec-7c78-4af3-b62f-4f305bd991bb",
            "created": "2026-09-26T05:31:21.853Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Tenable Minnesota Water Utilities",
                    "description": "Research Special Operations. (2026, July 28). Coordinated \"cyberattack\" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.",
                    "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T05:31:21.853Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) locked out operators by changing the PLCs passwords and IP addresses.(Citation: Tenable Minnesota Water Utilities)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f862418a-e7b4-4783-8949-7145f3dee665",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.262Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f86bc28e-6293-411e-8bbe-2e2717286529",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.262Z",
            "description": "Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--c7257b6e-4159-4771-b1f3-2bb93adaecac",
            "target_ref": "attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f86bde61-c4ec-4d40-9768-32e9b52c1702",
            "created": "2023-03-22T15:52:30.607Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "PLCTop20 Mar 2023",
                    "description": "PLC Security, Top 20 Community. (2021, June 15). Secure PLC Coding Practices: Top 20 version 1.0. Retrieved March 22, 2023.",
                    "url": "https://plc-security.com/content/Top_20_Secure_PLC_Coding_Practices_V1.0.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.263Z",
            "description": "Devices and programs should validate the content of any remote parameter changes, including those from HMIs, control servers, or engineering workstations.(Citation: PLCTop20 Mar 2023)",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517",
            "target_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f8c77472-9a3a-4d2b-8a04-c7c6deee7e34",
            "created": "2026-10-07T20:07:43.817Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:07:43.817Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9164f95-51d4-4b6c-92d8-0cafe4b97e6c",
            "created": "2025-09-24T18:13:30.126Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.768Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f92764db-a880-4726-9d28-a035170f790c",
            "created": "2023-09-28T21:22:35.236Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.263Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9907fb1-976b-4f51-ac13-b45f2ff9452b",
            "created": "2023-09-28T19:48:37.072Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.264Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9aa3364-a1eb-4776-ae03-c39b250545a0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.264Z",
            "description": "Review the integrity of project files to verify they have not been modified by adversary behavior. Verify a cryptographic hash for the file with a known trusted version, or look for other indicators of modification (e.g., timestamps).\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--bcf91ebc-f316-4e19-b2f6-444e9940c697",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9c29dd4-1c5e-4f7e-b60a-862319a6d0a0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.264Z",
            "description": "Allow for code signing of any project files stored at rest to prevent unauthorized tampering. Ensure the signing keys are not easily accessible on the same system.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
            "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9e33311-f162-4ebd-b944-8704f6dc0fd4",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--ab3f0926-58e2-485e-987c-66b541d9de97",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9ee9476-5487-4535-93fd-6b0cbbda0471",
            "created": "2023-09-28T20:02:45.697Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.264Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fa1bde35-63d9-4c5c-969b-2c17c29089fa",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.264Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fa391554-a3c0-4b89-9083-a53d299c5fad",
            "created": "2023-09-29T16:39:18.448Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.265Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--55e7e5c1-3760-4451-bae0-e79b29f452c5",
            "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--faa5ba6b-bbc4-47ab-a737-6dc1d8b31efd",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--7f41ed29-fdc6-4c28-ba10-9de1aa129f7e",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fac4bc88-af9b-4eec-b041-e4138b49c3c0",
            "created": "2023-09-29T16:28:04.180Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.781Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fad25140-73de-40d5-a010-3464188db973",
            "created": "2023-09-25T20:51:07.162Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.265Z",
            "description": "All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0",
            "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fadbdca3-3c98-497c-a156-e53b89664359",
            "created": "2023-09-28T20:16:55.038Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.266Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fadc8348-837b-4d7d-91a2-679117e5fd7b",
            "created": "2026-04-22T20:11:46.591Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CERT Polska",
                    "description": "CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.",
                    "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:20.120Z",
            "description": "During the [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063), the adversaries remotely executed commands on systems using [PsExec](https://attack.mitre.org/software/S0029) to gather information about running processes, network connections, routing tables, ARP cache, and contents of user directories.(Citation: CERT Polska)",
            "relationship_type": "uses",
            "source_ref": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
            "target_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--faf163b6-4e35-43d6-9c0c-83d91d215854",
            "created": "2024-09-11T22:57:39.900Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Claroty Fuxnet 2024",
                    "description": "Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.",
                    "url": "https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.266Z",
            "description": "[Fuxnet](https://attack.mitre.org/software/S1157) physically destroyed NAND memory chips on impacted devices through repeated bit-flip operations.(Citation: Claroty Fuxnet 2024)",
            "relationship_type": "uses",
            "source_ref": "malware--931e2489-8078-4f9f-85b2-a9211950e75b",
            "target_ref": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fb4c7d03-e05e-407f-b9ed-5cfd2f446ad4",
            "created": "2026-10-07T20:08:23.781Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T20:11:23.757Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a",
            "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fb4ee993-feb0-414f-b724-6ba392b1e560",
            "created": "2025-09-29T19:10:44.136Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.266Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fb8530c7-b6d7-44be-851e-1eb773f47e72",
            "created": "2026-04-22T16:41:15.170Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.266Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c",
            "target_ref": "x-mitre-asset--0804f037-a3b9-4715-98e1-9f73d19d6945",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fbeb6178-0a13-4573-bb74-7d2e5a2fe082",
            "created": "2026-10-07T21:45:04.555Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-10-07T21:45:04.555Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
            "target_ref": "x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc02e858-0e4d-462c-8f66-f7289677c559",
            "created": "2026-04-22T17:51:53.280Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.267Z",
            "description": "Ensure permissions restrict project file access to only engineer and technician user groups and accounts.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--f9fcb3ec-6de0-4559-8cd9-ef1c0c7d1971",
            "target_ref": "attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc189fa0-1235-46ac-a802-f226dc0ec4e1",
            "created": "2023-09-29T17:38:28.664Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:28:49.151Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
            "target_ref": "x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc3a187f-7437-413f-bea4-14936ce86512",
            "created": "2025-10-21T15:10:28.402Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2025-10-21T15:10:28.402Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--87493fa2-bb78-4e28-b882-d79eecd10740",
            "target_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc4803cb-d6bf-4674-bf40-d4b0997824ba",
            "created": "2018-04-18T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Eduard Kovacs May 2018",
                    "description": "Eduard Kovacs 2018, May 21 Group linked to Shamoon attacks targeting ICS networks in Middle East and UK Retrieved September 12, 2024.",
                    "url": "https://web.archive.org/web/20220120001230/https://www.cyberviser.com/2018/05/group-linked-to-shamoon-attacks-targeting-ics-networks-in-middle-east-and-uk/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:28.016Z",
            "description": "[ALLANITE](https://attack.mitre.org/groups/G1000) leverages watering hole attacks to gain access into electric utilities. (Citation: Eduard Kovacs May 2018)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc508fcc-6f19-44da-bbc0-de6aaa627d04",
            "created": "2025-09-29T19:16:18.456Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.267Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc77a4bc-1383-492a-a04b-9062345ced53",
            "created": "2026-04-22T16:06:19.136Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.267Z",
            "description": "Filter for protocols and payloads associated with firmware activation or updating activity.",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
            "target_ref": "attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc8e2629-c7ea-4b3c-b614-edde1a700f27",
            "created": "2026-04-22T20:16:16.558Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fc9e2b69-f0f6-4279-ab07-ea18eef19740",
            "created": "2026-09-25T20:35:14.655Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-25T20:35:14.655Z",
            "description": "Limit retrieval and execution of untrusted web or document-based active content on ICS workstations and jump hosts, especially where those systems can reach control assets. ",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "target_ref": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcb02e3f-3a41-46fc-8014-f1e95b14e28a",
            "created": "2026-04-22T21:38:15.078Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcb7733f-553d-43de-a8c6-c85a5cd65041",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "description": "Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcba6a58-72b0-4d54-a887-740624e22f6f",
            "created": "2024-03-26T15:42:36.840Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcc33052-42c2-485c-903c-cd86e5a87f34",
            "created": "2022-09-28T20:26:09.928Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Wylie-22",
                    "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
                    "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) can login to Omron PLCs using hardcoded credentials, which is documented in CVE-2022-34151.(Citation: Wylie-22) ",
            "relationship_type": "uses",
            "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
            "target_ref": "attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcd3fdbf-4909-48ab-85c4-ce4b34172eb0",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "description": "Restrict browsers to limit the capabilities of malicious ads and Javascript.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144",
            "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcd7c2bf-638e-409f-bc36-fff28c3cc68f",
            "created": "2025-09-29T19:03:28.185Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fcdf1912-dfc8-4cc3-92de-c6689353dd8e",
            "created": "2026-04-23T00:29:11.945Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.268Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd1bde9f-b2a5-48e2-ac92-cb6097040a71",
            "created": "2025-09-24T18:04:32.387Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
            "target_ref": "x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd1f3d4e-825f-4b25-aaf7-c82823ccf341",
            "created": "2025-09-24T18:22:03.083Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd309395-8fcc-402c-9227-90ac897fd602",
            "created": "2024-03-26T15:41:39.905Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--77d9c726-b53e-481d-8bcc-1068aebfbb9d",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd3bc308-82cd-49c9-a41e-9b19ce04b3cd",
            "created": "2023-10-02T20:23:41.227Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "target_ref": "x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd52f382-115f-483a-82c1-bb31fe5d5eb6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Department of Homeland Security September 2016",
                    "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
                    "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
                },
                {
                    "source_name": "Dwight Anderson 2014",
                    "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
                    "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
                },
                {
                    "source_name": "Karen Scarfone; Paul Hoffman September 2009",
                    "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
                },
                {
                    "source_name": "Keith Stouffer May 2015",
                    "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
                    "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.(Citation: Karen Scarfone; Paul Hoffman September 2009)(Citation: Keith Stouffer May 2015)(Citation: Department of Homeland Security September 2016)(Citation: Dwight Anderson 2014) \n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
            "target_ref": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fd8cd074-9e66-45f3-b41f-71f7aaf00ee6",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.269Z",
            "description": "Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549",
            "target_ref": "attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fdc20415-c9a1-405e-80af-3d297894e8fa",
            "created": "2023-09-28T19:58:30.849Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.270Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fe19d9d1-a560-425d-a41a-a643199aa79b",
            "created": "2026-04-22T20:33:11.987Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-07-31T20:48:57.009Z",
            "relationship_type": "detects",
            "source_ref": "x-mitre-detection-strategy--c4ddc0d7-0296-4d92-9ae1-1a4b7b5d1640",
            "target_ref": "attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fe22f626-ddf3-4d5e-97d1-058878d7830f",
            "created": "2023-09-28T21:10:39.025Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:30:36.798Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
            "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fe265dd7-2c1a-4c75-8aa8-12d0c82c7926",
            "created": "2023-09-28T21:26:59.998Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.270Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fe3bd9f0-2cdb-420d-88fa-352125bd7f28",
            "created": "2025-09-24T18:22:16.837Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.270Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
            "target_ref": "x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--feb32f07-00f0-404f-920d-8891be40b655",
            "created": "2025-09-29T19:08:19.567Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.271Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ff021e27-63be-41f4-bc4d-2ce75d8a3ecb",
            "created": "2023-09-28T19:56:26.241Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.271Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
            "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ff107632-751b-4efb-86bd-af670b48d35d",
            "created": "2023-09-28T21:21:30.387Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.271Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
            "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ff3f0668-98df-44c1-88c2-711f05720eb8",
            "created": "2020-09-21T17:59:24.739Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.271Z",
            "description": "Restrict configurations changes and firmware updating abilities to only authorized individuals.\n",
            "relationship_type": "mitigates",
            "source_ref": "course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd",
            "target_ref": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ff63658f-6d46-48b4-b524-d02dd715be42",
            "created": "2026-09-26T04:58:54.550Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "CISA-AA26-097A",
                    "description": "Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.",
                    "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-26T04:58:54.550Z",
            "description": "During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), one victim reported actors leveraged Dropbear Secure Shell (SSH) software to enable remote access over port 22.(Citation: CISA-AA26-097A)",
            "relationship_type": "uses",
            "source_ref": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
            "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ffc5bbce-8d9c-4276-9dc6-efed5c01af8b",
            "created": "2017-05-31T21:33:27.074Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "Joe Slowik April 2019",
                    "description": "Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 ",
                    "url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-09-03T20:31:39.387Z",
            "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) can move laterally through industrial networks by means of the SMB service. (Citation: Joe Slowik April 2019)",
            "relationship_type": "uses",
            "source_ref": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
            "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ffd2ae1d-6c1d-4d27-8cf0-bc745100bba7",
            "created": "2026-04-22T20:38:50.866Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-04-29T14:23:06.272Z",
            "relationship_type": "targets",
            "source_ref": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
            "target_ref": "x-mitre-asset--85f285f9-0a48-4998-921d-8a47d81c0e6d",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "x_mitre_deprecated": false,
            "x_mitre_attack_spec_version": "3.3.0"
        },
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "created": "2017-06-01T00:00:00.000Z",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "modified": "2026-05-12T16:33:30.227Z",
            "name": "The MITRE Corporation",
            "identity_class": "organization",
            "x_mitre_attack_spec_version": "3.2.0"
        },
        {
            "definition": {
                "statement": "Copyright 2015-2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation."
            },
            "id": "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168",
            "type": "marking-definition",
            "spec_version": "2.1",
            "created": "2017-06-01T00:00:00.000Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "definition_type": "statement"
        }
    ]
}